emotet | c8f8d19a0c2bc553e79e0846c22d1e15cc0040c97996dc34ee5f717672aab444

Analysis

Target
emotet_exe_e5_c8f8d19a0c2bc553e79e0846c22d1e15cc0040c97996dc34ee5f717672aab444_2022-03-21__124143.dll
Size 780KB
Sample220321-pxcfgscca8
SHA256 c8f8d19a0c2bc553e79e0846c22d1e15cc0040c97996dc34ee5f717672aab444
MD5 50e70a39d4a7ba9d1672cb586396b93b
SHA1 b537b4bbc2f4bb31010a617b206ee8c5f34a5d92
SHA512 0d6af3d8dec95bbd1d5343dd8ad59bd89642d467f49eff3eb6358933401b1f12147fe005d7d8ae7ab9702f9c495cb8b2be61a35f2a3207b314006473dcdcae99
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
448	regsvr32.exe
448	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 448	3464	regsvr32.exe	83
PID 3464 wrote to memory of 448	3464	regsvr32.exe	83
PID 3464 wrote to memory of 448	3464	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c8f8d19a0c2bc553e79e0846c22d1e15cc0040c97996dc34ee5f717672aab444_2022-03-21__124143.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c8f8d19a0c2bc553e79e0846c22d1e15cc0040c97996dc34ee5f717672aab444_2022-03-21__124143.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448

memory/448-134-0x0000000002E10000-0x0000000002E5C000-memory.dmp

Download