emotet | 1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373

Analysis

Target
emotet_exe_e5_1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373_2022-03-21__185043.dll
Size 494KB
Sample220321-xhg2esded2
SHA256 1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373
MD5 5fa5af8d66395a5a7fae4d94985ef297
SHA1 24b9f5960aa0b601356dd9b95c27e595b1733ad4
SHA512 f41e2d89e53691efd056ae467385d2649ca61e39fe9cc55c43c3996c3f1b9ef066014679e9ceffdf103604ba167c29e8b9c4560a577f235c9649b42cf693cdf3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	regsvr32.exe
3804	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3804	2700	regsvr32.exe	78
PID 2700 wrote to memory of 3804	2700	regsvr32.exe	78
PID 2700 wrote to memory of 3804	2700	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373_2022-03-21__185043.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373_2022-03-21__185043.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

memory/3804-130-0x0000000010000000-0x0000000010027000-memory.dmp

Download