emotet | 992cf5ac021e92a23872c712c88f81a89cb5faf3acd6368c854ac43b910ce7b9

Analysis

Target
fb181a4fbe014a7d76fd104f898fd8de.dll
Size 780KB
Sample220321-symjmaddd3
SHA256 992cf5ac021e92a23872c712c88f81a89cb5faf3acd6368c854ac43b910ce7b9
MD5 fb181a4fbe014a7d76fd104f898fd8de
SHA1 bab8edf93aac85c758a33de771531f6553569397
SHA512 33b3a887a14787775ca404134c7ee64fe37123750dbee686f4757bc6341392e4a2c5c4e36e0852f66d44481207fc9e39235b06c6b083391d178d1e0aa24a416f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27
PID 1956 wrote to memory of 1100	1956	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fb181a4fbe014a7d76fd104f898fd8de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fb181a4fbe014a7d76fd104f898fd8de.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

memory/1100-55-0x0000000074F31000-0x0000000074F33000-memory.dmp

Download

memory/1100-57-0x0000000000220000-0x0000000000247000-memory.dmp

Download

memory/1956-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Download