emotet | a7b9325f156866c248a1f35e017fa92b2244d3d4f1f91dd23546d4f0ce419f07

Analysis

Target
a7b9325f156866c248a1f35e017fa92b2244d3d4f1f91dd23546d4f0ce419f07.dll
Size 1012KB
Sample220322-p73qesfbd2
SHA256 a7b9325f156866c248a1f35e017fa92b2244d3d4f1f91dd23546d4f0ce419f07
MD5 8b248b2f7a5f2d8bb8cde2cb99c593e2
SHA1 afad58d8d14a140f6d727879d197f850adf6df8e
SHA512 20cb33f22116874f9738275fcc330c49047368cf91f0d1abcdb3ad7c5d0634e26c43431a5424b0acfaa7dd094080ce7e7329688ebcd243b9d708df2c9128c407
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27
PID 1216 wrote to memory of 1684	1216	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a7b9325f156866c248a1f35e017fa92b2244d3d4f1f91dd23546d4f0ce419f07.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a7b9325f156866c248a1f35e017fa92b2244d3d4f1f91dd23546d4f0ce419f07.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

memory/1216-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/1684-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1684-56-0x0000000000300000-0x0000000000328000-memory.dmp

Download