emotet | f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5

Analysis

Target
f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
Size 668KB
Sample220323-lecfzsbfc6
SHA256 f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5
MD5 9abdf30b7b8560e637c422613b4ae918
SHA1 ff14a45fd2bbfecfc6a7b1eac0e54b5261d53658
SHA512 68af1d8c5e1af5cd8941785d390d6e45b0806ea42e06bb083d7f41d3c8d317fe7a8beb8d44911a4edeed6f3f2eb99a799d6b3cc979c3b8eb83d094c6cc676f7e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1168	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27
PID 1380 wrote to memory of 1168	1380	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f2f8e97a9634396d442594cd63abdc01a6a39622d127a40dc258d2f6b52770d5.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

memory/1168-56-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/1168-58-0x0000000000600000-0x0000000000627000-memory.dmp

Download

memory/1380-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download