emotet | 135ebb4a1aaf107815c70d8e6197e4177a7317b960f78313719ed0eed1553543

Analysis

Target
62b7bd320388cb22ab4502bbaa7934d8.dll
Size 480KB
Sample220320-3qlmgagdd5
SHA256 135ebb4a1aaf107815c70d8e6197e4177a7317b960f78313719ed0eed1553543
MD5 62b7bd320388cb22ab4502bbaa7934d8
SHA1 a8b3d2c893150fa4f799c1d9711e4da12a51731c
SHA512 15fc8df78cd960347ded5d117f60a008b56e0e8c2d41872674f71f3d31b5643164de3f1322a4a745d7f8e291fb566fdc2bd2994f389aae8aac55d79bc1ac6552
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1548	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27
PID 748 wrote to memory of 1548	748	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62b7bd320388cb22ab4502bbaa7934d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62b7bd320388cb22ab4502bbaa7934d8.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

memory/748-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Download

memory/1548-55-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Download

memory/1548-56-0x00000000008E0000-0x0000000000907000-memory.dmp

Download