emotet | 65fbbf8888076e155b2531e54c0e05f4971b932774db2477f7f129f06b95d05b

Analysis

Target
65fbbf8888076e155b2531e54c0e05f4971b932774db2477f7f129f06b95d05b.dll
Size 684KB
Sample220323-pa1jssdfd2
SHA256 65fbbf8888076e155b2531e54c0e05f4971b932774db2477f7f129f06b95d05b
MD5 31a3a54b84c62745876668186e4fd837
SHA1 2554d48b601efc35a26ddbbb67773e7d6b741816
SHA512 7f8b519397111da4909ddf626911281af732a6681d1ad948121b6742a557aa38f9d572dd43d4151630959122d97786f8139240f8b6db3cda534f5e9374b67f9c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1460	1616	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\65fbbf8888076e155b2531e54c0e05f4971b932774db2477f7f129f06b95d05b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\65fbbf8888076e155b2531e54c0e05f4971b932774db2477f7f129f06b95d05b.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

memory/1460-56-0x00000000752C1000-0x00000000752C3000-memory.dmp

Download

memory/1460-57-0x0000000000210000-0x0000000000237000-memory.dmp

Download

memory/1616-54-0x000007FEFBC51000-0x000007FEFBC53000-memory.dmp

Download