emotet | 6690833b0b94d6c0cd1ee94a7aaba4a803e8342c096140f88dc9ff4988d8af50

Analysis

Target
6690833b0b94d6c0cd1ee94a7aaba4a803e8342c096140f88dc9ff4988d8af50.dll
Size 996KB
Sample220323-kdpt9aaed2
SHA256 6690833b0b94d6c0cd1ee94a7aaba4a803e8342c096140f88dc9ff4988d8af50
MD5 30921bee1a24659091ead5d192994958
SHA1 93ee737b2b31963925d0b4ea14ee4fb33fb02c01
SHA512 822462ef6098af08004c32c9408ea119f9ed600a0ad2ab49f6c786359942bb0a5174c9086c16cfc9bae7e74fcbc0a9c9ed23b076a8d460e8f05525c0de2ea984
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
972	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27
PID 1212 wrote to memory of 972	1212	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6690833b0b94d6c0cd1ee94a7aaba4a803e8342c096140f88dc9ff4988d8af50.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6690833b0b94d6c0cd1ee94a7aaba4a803e8342c096140f88dc9ff4988d8af50.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

memory/972-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/972-57-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1212-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download