emotet | 74ddfc732b61473839faaf083d3fb654fe0622fc862f08b91fee7f0210a86309

Analysis

Target
16f0c6a54fde894a314d6ac4289015e9.dll
Size 504KB
Sample220321-ndp2ssbfd5
SHA256 74ddfc732b61473839faaf083d3fb654fe0622fc862f08b91fee7f0210a86309
MD5 16f0c6a54fde894a314d6ac4289015e9
SHA1 f0753192d6120bc26f780cfdcd5ed7052839f7aa
SHA512 3c010c435055e4445687c1716bca1bdf84de3cef696aba247b2ed90ef8bd87f476a15c44e892a768b369e858608a9a4dc14c658abe428433e7563efe6b2f55a4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2032	2028	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\16f0c6a54fde894a314d6ac4289015e9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\16f0c6a54fde894a314d6ac4289015e9.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

memory/2028-54-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmp

Download

memory/2032-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Download

memory/2032-56-0x0000000000140000-0x0000000000168000-memory.dmp

Download