emotet | 36dfaedeb59ca1de52686de865d4d06dc3c3635ad2f2fed8744fc8f1f3283e8c

Analysis

Target
36dfaedeb59ca1de52686de865d4d06dc3c3635ad2f2fed8744fc8f1f3283e8c.dll
Size 2.8MB
Sample220323-mkdfxacdc4
SHA256 36dfaedeb59ca1de52686de865d4d06dc3c3635ad2f2fed8744fc8f1f3283e8c
MD5 a2f24a2b3e37f18f338052b33ec45365
SHA1 c0ed7ace2f6866f4872d680c51bde0a6c8671049
SHA512 4c70df74e3a359e5f96f97db319f729d4383d8b49d77550ff82570b7cfedc8838521900384b8d3d0994d74377e54cb9f48a2c5ad39a496fdd424684646870494
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1528	1684	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\36dfaedeb59ca1de52686de865d4d06dc3c3635ad2f2fed8744fc8f1f3283e8c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\36dfaedeb59ca1de52686de865d4d06dc3c3635ad2f2fed8744fc8f1f3283e8c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528

memory/1528-56-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/1528-57-0x0000000000540000-0x0000000000567000-memory.dmp

Download

memory/1684-54-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Download