emotet | b7e057f091e36ec983c83b5c0ca00f4e87f402b47a11bbc84d295d336bc64f85

Analysis

Target
b7e057f091e36ec983c83b5c0ca00f4e87f402b47a11bbc84d295d336bc64f85.dll
Size 684KB
Sample220323-phbkmsdhb9
SHA256 b7e057f091e36ec983c83b5c0ca00f4e87f402b47a11bbc84d295d336bc64f85
MD5 a00455d14adc563751b8a64f446bb09c
SHA1 a72949df897ac57abaefcfe377ecd38c72b986d1
SHA512 35da1c82e2520168eb7c8a618279c1e4d93c11c31d705a79c064f210cc31fff00ce45fba30ef1b3fd8cce4f1de1b07e3b4cfc0fbecd2c8187aa57bf6249a12af
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1644	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27
PID 1828 wrote to memory of 1644	1828	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7e057f091e36ec983c83b5c0ca00f4e87f402b47a11bbc84d295d336bc64f85.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7e057f091e36ec983c83b5c0ca00f4e87f402b47a11bbc84d295d336bc64f85.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644

memory/1644-56-0x00000000759C1000-0x00000000759C3000-memory.dmp

Download

memory/1644-57-0x0000000000630000-0x0000000000657000-memory.dmp

Download

memory/1828-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download