emotet | 4666f2e0c6a76802c7787567f85af0eade264a31faca063b906debbf87af7633

Analysis

Target
4666f2e0c6a76802c7787567f85af0eade264a31faca063b906debbf87af7633.dll
Size 996KB
Sample220323-kchpjsaea3
SHA256 4666f2e0c6a76802c7787567f85af0eade264a31faca063b906debbf87af7633
MD5 2faa9d8d86b804721d100a8e9a74fb00
SHA1 159f7746994dfc09fa86d5c097984507377502ec
SHA512 c5d5b981c5302140d857c50afd63fb0aca3dd64cd7b9e428fd1bfad86e4dc055e7eefc743dc28d9fd6018429b13b62a10546b6fa0902fce834fa991efbdc759d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
864	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27
PID 1740 wrote to memory of 864	1740	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4666f2e0c6a76802c7787567f85af0eade264a31faca063b906debbf87af7633.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4666f2e0c6a76802c7787567f85af0eade264a31faca063b906debbf87af7633.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

memory/864-56-0x0000000075691000-0x0000000075693000-memory.dmp

Download

memory/864-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1740-54-0x000007FEFB7A1000-0x000007FEFB7A3000-memory.dmp

Download