emotet | 501409ff9ba9904ff82b74468291d6ae8be4df2b77991679fce5f031bc599e92

Analysis

Target
emotet_exe_e5_501409ff9ba9904ff82b74468291d6ae8be4df2b77991679fce5f031bc599e92_2022-03-22__000026.dll
Size 494KB
Sample220322-aawtaaeaa8
SHA256 501409ff9ba9904ff82b74468291d6ae8be4df2b77991679fce5f031bc599e92
MD5 d8460a58321fc081781b364481caa30c
SHA1 257e0561e36c6c5f417a0277410b502155527047
SHA512 522e23cbcb7e62c169b6e0f44b025a480f48df6b305df2b1b175e3dc6f91cc5bef6947d853b7e059bcf20aa8661b3b8dee717653a9a6f8c5a5e37fb6ef71b6e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3148	regsvr32.exe
3148	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 3148	204	regsvr32.exe	79
PID 204 wrote to memory of 3148	204	regsvr32.exe	79
PID 204 wrote to memory of 3148	204	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_501409ff9ba9904ff82b74468291d6ae8be4df2b77991679fce5f031bc599e92_2022-03-22__000026.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_501409ff9ba9904ff82b74468291d6ae8be4df2b77991679fce5f031bc599e92_2022-03-22__000026.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148

memory/3148-133-0x0000000010000000-0x0000000010027000-memory.dmp

Download