emotet | 02f95c7012f3f279a51d2a0c87f221a0d19c3febd3ea8a52fd04a26796dd2f13

Analysis

Target
02f95c7012f3f279a51d2a0c87f221a0d19c3febd3ea8a52fd04a26796dd2f13.dll
Size 684KB
Sample220323-n5tt3addf2
SHA256 02f95c7012f3f279a51d2a0c87f221a0d19c3febd3ea8a52fd04a26796dd2f13
MD5 649ee1faacd047a42a63125902c29541
SHA1 f4f797a4cb41ecd61e997566250e23c263eb0484
SHA512 706cb2abc3b1e11c30d7ec4b09ec904a834b3a2534aed52a7aab4a48c99edaf16e18deb7218266688621fab19a328c5389b416d87e7388f26ef4e090ebd3d52e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1028	1692	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02f95c7012f3f279a51d2a0c87f221a0d19c3febd3ea8a52fd04a26796dd2f13.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02f95c7012f3f279a51d2a0c87f221a0d19c3febd3ea8a52fd04a26796dd2f13.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

memory/1028-56-0x00000000750C1000-0x00000000750C3000-memory.dmp

Download

memory/1028-57-0x00000000002F0000-0x0000000000317000-memory.dmp

Download

memory/1692-54-0x000007FEFB5A1000-0x000007FEFB5A3000-memory.dmp

Download