emotet | 3aa99d751b83e32f2a580b7d1334d55451f06e55452d56affddd43c97d5bc135

Analysis

Target
afa8289219f5d931c487aabfcfd894a2.dll
Size 480KB
Sample220320-3jvxkagda8
SHA256 3aa99d751b83e32f2a580b7d1334d55451f06e55452d56affddd43c97d5bc135
MD5 afa8289219f5d931c487aabfcfd894a2
SHA1 94635b0b7b80767efa3be0626fe221f30cb44173
SHA512 49dc8890a0e049b3ceaac4bc2260f976c5370ce2108743e9815d8fbb7dc497bd9da75ee9840300231d3c297c0abf643017ba6f8c4091367ad1ef1a9b8fbdecdc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27
PID 2004 wrote to memory of 1980	2004	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\afa8289219f5d931c487aabfcfd894a2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\afa8289219f5d931c487aabfcfd894a2.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

memory/1980-55-0x0000000074C61000-0x0000000074C63000-memory.dmp

Download

memory/1980-56-0x00000000002B0000-0x00000000002D7000-memory.dmp

Download

memory/2004-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download