emotet | ab733ee3e0bfcc9193ef3901adf0412b9fa86fa03434cac6157a6d393d343c64

Analysis

Target
ab733ee3e0bfcc9193ef3901adf0412b9fa86fa03434cac6157a6d393d343c64.dll
Size 684KB
Sample220323-pgtptsacek
SHA256 ab733ee3e0bfcc9193ef3901adf0412b9fa86fa03434cac6157a6d393d343c64
MD5 0cc041a42d9e6acbeaaa450e4fd247e9
SHA1 03c053f9cf0375c0b99d2c24e13f4a37c20b6fd3
SHA512 2b6d8412aefea63e92b9cc20aa8c68b8b677707ca8fc240539bd6feeec23622cdfdfe4038d37938235b4331268b7db40186116a9013cfa83e2f59272be564f10
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1488	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27
PID 1556 wrote to memory of 1488	1556	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab733ee3e0bfcc9193ef3901adf0412b9fa86fa03434cac6157a6d393d343c64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ab733ee3e0bfcc9193ef3901adf0412b9fa86fa03434cac6157a6d393d343c64.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488

memory/1488-56-0x00000000757E1000-0x00000000757E3000-memory.dmp

Download

memory/1488-57-0x00000000002D0000-0x00000000002F7000-memory.dmp

Download

memory/1556-54-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmp

Download