emotet | 869e22d6386890b9f85c310de7fed94cb8696a0ea8a8dd94f7e0af7067f86a8d

Analysis

Target
869e22d6386890b9f85c310de7fed94cb8696a0ea8a8dd94f7e0af7067f86a8d.dll
Size 996KB
Sample220323-kchpjsaea2
SHA256 869e22d6386890b9f85c310de7fed94cb8696a0ea8a8dd94f7e0af7067f86a8d
MD5 4b99c12a46a15759d9c90d6ca7d05597
SHA1 78cdc079754c38b52f523c721582b521198b1b4b
SHA512 a84e72c049d6a96d482fbee618c4a52beb473ba16d71f62e6fc0bc51443bdbdee53a4d1ea5992b3a908df3780ac0c12753e22489187748a86968629ef225a16a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1328	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1328	1632	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\869e22d6386890b9f85c310de7fed94cb8696a0ea8a8dd94f7e0af7067f86a8d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\869e22d6386890b9f85c310de7fed94cb8696a0ea8a8dd94f7e0af7067f86a8d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

memory/1328-56-0x0000000075EA1000-0x0000000075EA3000-memory.dmp

Download

memory/1328-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1632-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Download