emotet | 17aca1edc6c633860de8aba7cf58fd018fffd6e620bbfa7a345ff96427124b5e

Analysis

Target
emotet_exe_e4_17aca1edc6c633860de8aba7cf58fd018fffd6e620bbfa7a345ff96427124b5e_2022-03-20__010056.dll
Size 796KB
Sample220320-bc8rasdfg5
SHA256 17aca1edc6c633860de8aba7cf58fd018fffd6e620bbfa7a345ff96427124b5e
MD5 2fa35a37067b1e190b5dd55ade2f9a58
SHA1 6b96e9ed4b3b4df4365b2032ab4fadb7913b0e52
SHA512 6651fd5627b25d33249db53d3a810a4aedf1744dfe85e3a3c51da6da32a92eb4317289c4edaa8323521e538615e55d867d8b28fc9dd130a0ed72de4ca473a070
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1860	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1860	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_17aca1edc6c633860de8aba7cf58fd018fffd6e620bbfa7a345ff96427124b5e_2022-03-20__010056.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_17aca1edc6c633860de8aba7cf58fd018fffd6e620bbfa7a345ff96427124b5e_2022-03-20__010056.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860

memory/1860-55-0x0000000075271000-0x0000000075273000-memory.dmp

Download

memory/1860-56-0x0000000000A60000-0x0000000000AAD000-memory.dmp

Download

memory/2016-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download