emotet | c644b5b77506d5ccc11aa330506341a527434010a655ea3cb44adfe3ba156fe2

Analysis

Target
79f37c9219b35c9a6395876c64d27ac6.dll
Size 480KB
Sample220320-2pdd2agce7
SHA256 c644b5b77506d5ccc11aa330506341a527434010a655ea3cb44adfe3ba156fe2
MD5 79f37c9219b35c9a6395876c64d27ac6
SHA1 da396cd350a794c87667c0baa39e816cfbf812bc
SHA512 079d0ba45b212529daef5bf7050c2d10b6a1c139100e9d4970a1045bf8fa73d963a1c2b658d43cdb6ad0350d00463003d55acaabc4a4eb5fc171ffa7a577c747
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1356	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\79f37c9219b35c9a6395876c64d27ac6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\79f37c9219b35c9a6395876c64d27ac6.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1356

memory/1356-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/1356-56-0x0000000000420000-0x0000000000447000-memory.dmp

Download

memory/2016-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download