emotet | a7ec0ad508e225c3012dee65ec610acdece2109e88787aa854ac2a100ef4537c

Analysis

Target
a7ec0ad508e225c3012dee65ec610acdece2109e88787aa854ac2a100ef4537c.dll
Size 688KB
Sample220323-kpy73afcak
SHA256 a7ec0ad508e225c3012dee65ec610acdece2109e88787aa854ac2a100ef4537c
MD5 04f1cf6235e532d983629290dc500aba
SHA1 cfdc9e9cab2a1fbc7ac27b0bebac8e995ee31538
SHA512 a7c52a36f50fb2536043a6a22af692344b54cc3cde054dcaa8171a67e4417168e76773eeebd58da7ea06cf27cb1fb2361b0658ee280ddf728f942eb85ede4f56
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1716	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27
PID 628 wrote to memory of 1716	628	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a7ec0ad508e225c3012dee65ec610acdece2109e88787aa854ac2a100ef4537c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a7ec0ad508e225c3012dee65ec610acdece2109e88787aa854ac2a100ef4537c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

memory/628-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download

memory/1716-56-0x0000000075B01000-0x0000000075B03000-memory.dmp

Download

memory/1716-57-0x0000000000240000-0x0000000000268000-memory.dmp

Download