emotet | 4ef44bed3cf4ab72b5b568f1f714c7cc2ae4454dade7c4abec31eadd71f15281

Analysis

Target
4ef44bed3cf4ab72b5b568f1f714c7cc2ae4454dade7c4abec31eadd71f15281.dll
Size 997KB
Sample220323-j2sqdaaba9
SHA256 4ef44bed3cf4ab72b5b568f1f714c7cc2ae4454dade7c4abec31eadd71f15281
MD5 d1d7bd87cf3511e4694ef551fb2d2293
SHA1 13282ad00281a2978d8adb2e5ade7b65828c28ba
SHA512 f38b085b6fbae9ba92dc6053c39961418993d51d9d603dfee6f0d0b1977a4df571c6f57267d7f0f140ee6a1cb97dc3fc80b505b03ca2b836b4f60f24bf0f3237
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1988	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1988	1528	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ef44bed3cf4ab72b5b568f1f714c7cc2ae4454dade7c4abec31eadd71f15281.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4ef44bed3cf4ab72b5b568f1f714c7cc2ae4454dade7c4abec31eadd71f15281.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

memory/1528-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1988-56-0x0000000074F21000-0x0000000074F23000-memory.dmp

Download

memory/1988-57-0x0000000010000000-0x0000000010028000-memory.dmp

Download