emotet | 4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b

Analysis

Target
4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
Size 996KB
Sample220323-kc6rdaaeb7
SHA256 4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b
MD5 50ab84e4eeb0593e1c0ab1fa38e9870b
SHA1 cb0889503af8e66e85074f8d73d16e72853adb22
SHA512 91042c3c8779f45c55b13b878b67adba0ec6b4b73cdfe3efa0a084b7352372f682dd83c6209f3c199f18f1ae383d1db71de120a25db074551c79ea5784116f7d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27
PID 1980 wrote to memory of 1816	1980	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4105825d0b8554eb99ca34cb9a29665e0f0c7e8f00686f024797dafeeb7cdd4b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1816-56-0x0000000075081000-0x0000000075083000-memory.dmp

Download

memory/1816-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1980-54-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Download