emotet | 60ecf0f74917a97bf1a8c609cb2aff9c6344aa9b18c227a779fdea1adb2bca40

Analysis

Target
20678850b1e2f8b70a1400e6883e5216.dll
Size 780KB
Sample220321-j96bfaade2
SHA256 60ecf0f74917a97bf1a8c609cb2aff9c6344aa9b18c227a779fdea1adb2bca40
MD5 20678850b1e2f8b70a1400e6883e5216
SHA1 739d8b1030b2d2364578fea96dbac8de2c924968
SHA512 8903576bcafa20bd5a4b0a22a1ff0247d8727603c7f8b55ced34171a9969d42e6668d125619da46c223428421a5cb20cc1c95e4bfdba9740476597f161f7905e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1724	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27
PID 940 wrote to memory of 1724	940	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20678850b1e2f8b70a1400e6883e5216.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20678850b1e2f8b70a1400e6883e5216.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724

memory/940-54-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Download

memory/1724-55-0x0000000076861000-0x0000000076863000-memory.dmp

Download

memory/1724-56-0x00000000002B0000-0x00000000002D7000-memory.dmp

Download