emotet | a0ac5000a949f7189bb2a6578980422db28cde5e43024d8bc668bf320ddb6c04

Analysis

Target
a0ac5000a949f7189bb2a6578980422db28cde5e43024d8bc668bf320ddb6c04.dll
Size 668KB
Sample220323-lacaesbeb2
SHA256 a0ac5000a949f7189bb2a6578980422db28cde5e43024d8bc668bf320ddb6c04
MD5 dac25a0f3ab7e6fbc9d5683dfd904fa4
SHA1 917d6385fad743fcc1f828e3e434c020c2daea3b
SHA512 207242c6c197c8d652c62fc3f1e4e50fd485053d7354b5ec3c411b03554b0079c39091ad4c366040a3a13bbae0966bc199cfdcd83c4a85a03b9604af61102412
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1616	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1616	1548	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a0ac5000a949f7189bb2a6578980422db28cde5e43024d8bc668bf320ddb6c04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a0ac5000a949f7189bb2a6578980422db28cde5e43024d8bc668bf320ddb6c04.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616

memory/1548-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/1616-56-0x0000000075611000-0x0000000075613000-memory.dmp

Download

memory/1616-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download