emotet | 2159f41b45bd367027d27640b327dc27d5ea172d2c9633ab9744a45538ef91f6

Analysis

Target
2159f41b45bd367027d27640b327dc27d5ea172d2c9633ab9744a45538ef91f6.dll
Size 588KB
Sample220322-qj5esafea4
SHA256 2159f41b45bd367027d27640b327dc27d5ea172d2c9633ab9744a45538ef91f6
MD5 0e2fe6406cf3318d44a0972401d1b7ff
SHA1 c6a30f5bdb8b4180fb39ba3d2f14c56c219784f9
SHA512 3bedb9e6502d0683246a51e446cc707327dbf5b9e3b4f9d01f872972abea6e29a703b25751d27af4eb42a17c5e8f90de58c3bd0257a462ca924c4514518afd13
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1604	regsvr32.exe
1604	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1604	5076	regsvr32.exe	83
PID 5076 wrote to memory of 1604	5076	regsvr32.exe	83
PID 5076 wrote to memory of 1604	5076	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2159f41b45bd367027d27640b327dc27d5ea172d2c9633ab9744a45538ef91f6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2159f41b45bd367027d27640b327dc27d5ea172d2c9633ab9744a45538ef91f6.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2640

memory/1604-134-0x0000000002A40000-0x0000000002A68000-memory.dmp

Download

memory/2640-138-0x000002976BEC0000-0x000002976BED0000-memory.dmp

Download

memory/2640-137-0x000002976BE60000-0x000002976BE70000-memory.dmp

Download

memory/2640-139-0x000002976C1D0000-0x000002976C1D4000-memory.dmp

Download