emotet | e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552

Analysis

Target
e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
Size 1004KB
Sample220322-qdstssfdb3
SHA256 e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552
MD5 00408cca71bb6341798538a2f59ee46c
SHA1 7f2f14e3a3ee09c79f93079fdcfe54aaed3747ce
SHA512 42fb51c77d4350d2d4c73d1439ca839b2add7b01ab60d18f93fea27178cb4b7dc19d3b95d67289cd5706eba73fb9cd3aa9b21bfb7e50fd4d9f2b60694b60e3ed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1876	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1876	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e9eb33cca5de62e3704eb46fc7f7a6ed23548928bcabe6be2add52aa99939552.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

memory/1876-55-0x0000000075271000-0x0000000075273000-memory.dmp

Download

memory/1876-56-0x00000000001D0000-0x00000000001F7000-memory.dmp

Download

memory/2016-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download