emotet | 342fbbda8e71c4cabbff0b1aed747c726983651bdec718b115c8771acd4c09a3

Analysis

Target
4e18bcb28ffa2620b0030cfcb2f23ee4.dll
Size 780KB
Sample220321-sn2kssdcb5
SHA256 342fbbda8e71c4cabbff0b1aed747c726983651bdec718b115c8771acd4c09a3
MD5 4e18bcb28ffa2620b0030cfcb2f23ee4
SHA1 0eefb63d0706e927e4d47acf61a032422b0b361f
SHA512 9402e69fbf732678c94fd3242c57be09752a0144200551cdd24f839ba215ab49f9e7397df9a5a23c5efe440d8c074679c1c1c489e00b2b47cbfa07efd78d78ff
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1812	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1812	1920	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4e18bcb28ffa2620b0030cfcb2f23ee4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4e18bcb28ffa2620b0030cfcb2f23ee4.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812

memory/1812-55-0x00000000759B1000-0x00000000759B3000-memory.dmp

Download

memory/1812-56-0x0000000000350000-0x0000000000377000-memory.dmp

Download

memory/1920-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download