emotet | 60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087

Analysis

Target
emotet_exe_e5_60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087_2022-03-21__185044.dll
Size 494KB
Sample220321-xhg2esdec8
SHA256 60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087
MD5 f9504b48a4d76799e1ffb35c9352c083
SHA1 809104e140234e0bdea52a12886b469ee29d40d7
SHA512 cb922ab6eab8ab1adc740ac574ed90ed168553632b442ce636b8353ed49f0a2c0f29dfb30bd09ce9675cf9185d30806554118af504ea778d1276d2bce0331180
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	regsvr32.exe
2092	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2092	3588	regsvr32.exe	83
PID 3588 wrote to memory of 2092	3588	regsvr32.exe	83
PID 3588 wrote to memory of 2092	3588	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087_2022-03-21__185044.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087_2022-03-21__185044.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092

memory/2092-134-0x0000000010000000-0x0000000010027000-memory.dmp

Download