emotet | acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f

Analysis

Target
acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
Size 668KB
Sample220323-lack7abeb6
SHA256 acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f
MD5 313fa72b5fe8f4574476bdf6feedaaf3
SHA1 735992b30d9dfdaff8433422fd8df308a0fe4dcc
SHA512 dd5b112315f4625930359b0efc707b9fdb9e5dce136d0de85062044ffd59eada2573096c3c336d7b7ee5a9ecee348c7fb4158e3fe48059040fdec8c7c41a897c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1832	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1832	1668	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\acc0d09221f88dd4d1471dffe5d8a48c75152448a78e258f50f92837f19ab01f.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

memory/1668-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download

memory/1832-56-0x0000000075E61000-0x0000000075E63000-memory.dmp

Download

memory/1832-57-0x0000000000760000-0x0000000000787000-memory.dmp

Download