emotet | 9d1fb7d39ec24c31d514d3499c068d27e93cbbfe10ee342484b43b6a4c0fe534

Analysis

Target
9d1fb7d39ec24c31d514d3499c068d27e93cbbfe10ee342484b43b6a4c0fe534.dll
Size 996KB
Sample220323-kabs8aadc9
SHA256 9d1fb7d39ec24c31d514d3499c068d27e93cbbfe10ee342484b43b6a4c0fe534
MD5 6673a6495c1ed27b0f36184de6ce79a4
SHA1 0eba120d0ba7a18a5166432f9aa1130b8d78e039
SHA512 511a7450eb9856228f79d466d3a1a7b830da9c8a33b3705a41700a28624d4c1a7f61c415fd14c6ffb9c27143192f8ae495bd984eb5c9e7cf024729f8aecc17b1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1824	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27
PID 1936 wrote to memory of 1824	1936	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9d1fb7d39ec24c31d514d3499c068d27e93cbbfe10ee342484b43b6a4c0fe534.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9d1fb7d39ec24c31d514d3499c068d27e93cbbfe10ee342484b43b6a4c0fe534.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824

memory/1824-56-0x00000000759B1000-0x00000000759B3000-memory.dmp

Download

memory/1824-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1936-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download