emotet | e4e46d3a69957097ff4c0272d4970ca907863837dd92e02467df55fc7277e91c

Analysis

Target
e4e46d3a69957097ff4c0272d4970ca907863837dd92e02467df55fc7277e91c.dll
Size 668KB
Sample220323-lc6xtabeh5
SHA256 e4e46d3a69957097ff4c0272d4970ca907863837dd92e02467df55fc7277e91c
MD5 cebc928bc744d73a831bbee9f8d4abfb
SHA1 8327489b7fbb4006b711f3b2556016bb55e62cfb
SHA512 9eff8e32d69e9d3917b10f8c9c8e05208e9e3b7493e11749da4e7ab37fc0969f90d92d030447dde1ff88780f93f6d4a4ee8a72b18469bde79905ad52678c750f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27
PID 304 wrote to memory of 956	304	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e4e46d3a69957097ff4c0272d4970ca907863837dd92e02467df55fc7277e91c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e4e46d3a69957097ff4c0272d4970ca907863837dd92e02467df55fc7277e91c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956

memory/304-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/956-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

memory/956-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download