emotet | 726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56

Analysis

Target
726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56.dll
Size 780KB
Sample220321-sfljlsdbe3
SHA256 726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56
MD5 4d3757c4c972d7bb24ab8d2f4c3976a4
SHA1 959cfd6dbbbce005a6fb3c0f3861c7bd3d984c83
SHA512 8b5912ed17a855269bfd5ce312ddff661f50fa8dee3006d30d27a96ce2dfccc863016769e5a11b3285bb9fb31f82b8361aeec5e630db5550deeb993c6c819fda
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1968	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27
PID 1796 wrote to memory of 1968	1796	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968

memory/1796-54-0x000007FEFC161000-0x000007FEFC163000-memory.dmp

Download

memory/1968-55-0x00000000767A1000-0x00000000767A3000-memory.dmp

Download

memory/1968-56-0x0000000000560000-0x0000000000587000-memory.dmp

Download