emotet | d99a841a5efc8a9427429115fa5b6c7fbfd568ee72f4123e319e203d731a860b

Analysis

Target
emotet_exe_e4_d99a841a5efc8a9427429115fa5b6c7fbfd568ee72f4123e319e203d731a860b_2022-03-21__000118.dll
Size 504KB
Sample220321-abgezsgdf6
SHA256 d99a841a5efc8a9427429115fa5b6c7fbfd568ee72f4123e319e203d731a860b
MD5 8e5f5f2c81fe8e9f1e8ae3433e707638
SHA1 4cd78985b2b6998911f20908a69fb06505bbfed6
SHA512 a1506fbb4ddc224875266107fb25cc491cfcc62136c2c1eaca0949d91be20d443eb3c0cd888ccef940a5a7fdd1b6e7e8ea284dd7fe69876c03af3889fad31450
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27
PID 904 wrote to memory of 1580	904	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d99a841a5efc8a9427429115fa5b6c7fbfd568ee72f4123e319e203d731a860b_2022-03-21__000118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d99a841a5efc8a9427429115fa5b6c7fbfd568ee72f4123e319e203d731a860b_2022-03-21__000118.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

memory/904-54-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Download

memory/1580-55-0x0000000076861000-0x0000000076863000-memory.dmp

Download

memory/1580-56-0x00000000001F0000-0x0000000000218000-memory.dmp

Download