emotet | 7e91e96d6ef719dec9bcef74396e42d4a8484a1cc6424fb907116ca7d5d59810

Analysis

Target
7e91e96d6ef719dec9bcef74396e42d4a8484a1cc6424fb907116ca7d5d59810.dll
Size 684KB
Sample220323-n8lymadee9
SHA256 7e91e96d6ef719dec9bcef74396e42d4a8484a1cc6424fb907116ca7d5d59810
MD5 5eb432d9f347a84d2c451bd519f0c91a
SHA1 49f6e16473b146ca99346feea847185857091d03
SHA512 eb759817c3ec1d319cafdc1ed81f179c0f973ba23bbe97384a58253c1024330a109b171c85e395f3f568d3f84daf3598ab52b6b1a9e4bff1f1c9d1eb47c498e5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27
PID 784 wrote to memory of 948	784	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7e91e96d6ef719dec9bcef74396e42d4a8484a1cc6424fb907116ca7d5d59810.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7e91e96d6ef719dec9bcef74396e42d4a8484a1cc6424fb907116ca7d5d59810.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948

memory/784-54-0x000007FEFC291000-0x000007FEFC293000-memory.dmp

Download

memory/948-56-0x00000000760B1000-0x00000000760B3000-memory.dmp

Download

memory/948-57-0x0000000001BA0000-0x0000000001BC7000-memory.dmp

Download