emotet | 1d0e52098565a050900abc975653c08183475f83ef4ce6feeb2a66cbf6070ada

Analysis

Target
a56996951afb07a28581e3bebbf18a5c.dll
Size 780KB
Sample220321-k7bvgsagg2
SHA256 1d0e52098565a050900abc975653c08183475f83ef4ce6feeb2a66cbf6070ada
MD5 a56996951afb07a28581e3bebbf18a5c
SHA1 b339e82d8ed90eaa86293a11334b27738bfd1e77
SHA512 fce6d50233b97f8295090e44c63a8600d6bdc6b26d82bfb30b3db67370bac2679ed3fdcd60f00a5c42a8134d1566b68b378267a7edfc8bd8552177b5abd7c403
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1092	1688	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a56996951afb07a28581e3bebbf18a5c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a56996951afb07a28581e3bebbf18a5c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092

memory/1092-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download

memory/1092-56-0x0000000000540000-0x0000000000567000-memory.dmp

Download

memory/1688-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Download