emotet | 836467af87d2e2881dc63abf165b017dd0673f5260dd13bdf82c166adb0d827a

Analysis

Target
836467af87d2e2881dc63abf165b017dd0673f5260dd13bdf82c166adb0d827a.dll
Size 996KB
Sample220323-kc6rdaaeb6
SHA256 836467af87d2e2881dc63abf165b017dd0673f5260dd13bdf82c166adb0d827a
MD5 0342d4dea984b8b9be5f035ad040a23a
SHA1 f049f23e20169d0d01371323e3a7b4c24bcc5a3b
SHA512 de15b5088e62c49a3005292eb190b71ae3f92a1b38cc81de59745b40c6b84a15132abba8981de23476365bf6188acd330e45c67466c05c3f0d08ca1a5c07b567
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27
PID 940 wrote to memory of 1580	940	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\836467af87d2e2881dc63abf165b017dd0673f5260dd13bdf82c166adb0d827a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\836467af87d2e2881dc63abf165b017dd0673f5260dd13bdf82c166adb0d827a.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

memory/940-54-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Download

memory/1580-56-0x0000000076861000-0x0000000076863000-memory.dmp

Download

memory/1580-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download