emotet | 643b6eb19856d33e771b0ff367bc6efdfb6ea893965bcd8f1bc3ac816d919570

Analysis

Target
643b6eb19856d33e771b0ff367bc6efdfb6ea893965bcd8f1bc3ac816d919570.dll
Size 996KB
Sample220323-kb39vsadh4
SHA256 643b6eb19856d33e771b0ff367bc6efdfb6ea893965bcd8f1bc3ac816d919570
MD5 63b7f77850cdf7a540bbaf91d12e9595
SHA1 03ef2f9523ba2f58275cc3c949903ca3dd98c68f
SHA512 f96bf8c3fa4af8a468604f94ba81689e5a82acb3851b79c73cc9df33ac14382e1261723a0b1d6d52f49fdb7aced3ee1f402858ab28b0a09a521c96340761d460
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
580	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27
PID 340 wrote to memory of 580	340	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\643b6eb19856d33e771b0ff367bc6efdfb6ea893965bcd8f1bc3ac816d919570.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\643b6eb19856d33e771b0ff367bc6efdfb6ea893965bcd8f1bc3ac816d919570.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:580

memory/340-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download

memory/580-56-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Download

memory/580-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download