emotet | 57a71cbfcf3d0040d51507ea05fc419de0a1884f4fd038c8e32cd68a2beab759

Analysis

Target
57a71cbfcf3d0040d51507ea05fc419de0a1884f4fd038c8e32cd68a2beab759.dll
Size 684KB
Sample220323-pa1jssdfc8
SHA256 57a71cbfcf3d0040d51507ea05fc419de0a1884f4fd038c8e32cd68a2beab759
MD5 7c300e4edcbdc9304667b9a864cb11e6
SHA1 6015f8a176bcc5f7ffd29335545245bdab988e49
SHA512 bed5f91f34c7a55ab86ac3fc3a624a3c9f0a2ea6e6486a65e07658784b676a89627e21bb9b989674f9e93f348a2c3b1f8d755aab89925446e0dc349b05509358
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1816	1900	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\57a71cbfcf3d0040d51507ea05fc419de0a1884f4fd038c8e32cd68a2beab759.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\57a71cbfcf3d0040d51507ea05fc419de0a1884f4fd038c8e32cd68a2beab759.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1816-56-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

Download

memory/1816-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download

memory/1900-54-0x000007FEFBD31000-0x000007FEFBD33000-memory.dmp

Download