emotet | d9205531a43302ba074367af4f6bea62ae2c23d1cd31fe0b5f76b8b09482d3ad

Analysis

Target
emotet_exe_e4_d9205531a43302ba074367af4f6bea62ae2c23d1cd31fe0b5f76b8b09482d3ad_2022-03-21__000117.dll
Size 504KB
Sample220321-abgezsgdf5
SHA256 d9205531a43302ba074367af4f6bea62ae2c23d1cd31fe0b5f76b8b09482d3ad
MD5 fd5c02fbe0f40468d3d6a0e1cccc8fbd
SHA1 1f65e8fec552306495ba752e266497f436586e2d
SHA512 37b48898a47ce165e5c1b9b6d567bfa591b33095a0f7952ce024b59f8ca8112f1b673f3bf4809d2c21d7b40c2dddb622531fd20ec96f28fe91b424917dc3e487
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27
PID 1560 wrote to memory of 1632	1560	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d9205531a43302ba074367af4f6bea62ae2c23d1cd31fe0b5f76b8b09482d3ad_2022-03-21__000117.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d9205531a43302ba074367af4f6bea62ae2c23d1cd31fe0b5f76b8b09482d3ad_2022-03-21__000117.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

memory/1560-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/1632-55-0x0000000075611000-0x0000000075613000-memory.dmp

Download

memory/1632-56-0x0000000000990000-0x00000000009B8000-memory.dmp

Download