emotet | dc7ef75007d6e9b0fd0c4ae309304ddc4e442dc194268d3b1a98ce8747177fd5

Analysis

Target
dc7ef75007d6e9b0fd0c4ae309304ddc4e442dc194268d3b1a98ce8747177fd5.dll
Size 1016KB
Sample220323-j1kclsaag8
SHA256 dc7ef75007d6e9b0fd0c4ae309304ddc4e442dc194268d3b1a98ce8747177fd5
MD5 e002ed7fabbe63600578475e5dbdfe13
SHA1 632ce1211f1a6d87ccd57fedd4cd1f470d41a036
SHA512 8d66e0dfddd34376afeb56d556ee8ad531f90fbd3d03df2bed83addfa653f2cee395717a684932be407b7f502479eb92c4c0ede5ae2326cdfcf5f5698c1dfeca
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1116	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1116	1104	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc7ef75007d6e9b0fd0c4ae309304ddc4e442dc194268d3b1a98ce8747177fd5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc7ef75007d6e9b0fd0c4ae309304ddc4e442dc194268d3b1a98ce8747177fd5.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

memory/1104-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/1116-56-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/1116-57-0x00000000003F0000-0x0000000000417000-memory.dmp

Download