emotet | 145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc

Analysis

Target
145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
Size 684KB
Sample220323-pbmpbsdfe9
SHA256 145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc
MD5 b92921ed45cd4675ba751b58a10fd42f
SHA1 bf3afc33182519e4a90446d7d7109d92c1791493
SHA512 127ae21af15242ce0e7b7a8347b7dba0ae974572c88272174b36af89e52f61be08c77dd4c102b966a9e8e2a3cc9dd2a9e7828f45f7757f04f7226e47895d17ed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1924	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1924	1616	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\145d7753cd237795e0093475a2ef112d8f7f3a5bd9cb4ea839db21a5121619dc.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

memory/1616-54-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Download

memory/1924-56-0x00000000763D1000-0x00000000763D3000-memory.dmp

Download

memory/1924-58-0x0000000000710000-0x0000000000737000-memory.dmp

Download