emotet | 2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd

Analysis

Target
emotet_exe_e5_2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd_2022-03-21__152159.dll
Size 1.0MB
Sample220321-ssf5nadce2
SHA256 2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd
MD5 484b10e6d0fad5629343668f7306cd83
SHA1 16c35b0e33739a6f57f99a1061045cc50a335350
SHA512 59ded5c48ceb8a27beb3d684009366498b45b3b91692863a7abf8ceac1612c4fdfddb3b937ee0e9941d8cf38541a940d051d9795a3c1380ae46be6cb3f0959cf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1164	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27
PID 284 wrote to memory of 1164	284	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd_2022-03-21__152159.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:284
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd_2022-03-21__152159.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

memory/284-54-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp

Download

memory/1164-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Download

memory/1164-56-0x00000000001E0000-0x0000000000207000-memory.dmp

Download