emotet | c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7

Analysis

Target
c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
Size 684KB
Sample220323-phz81adhd2
SHA256 c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7
MD5 5d58d59f71b41ac66a5a308a8424264f
SHA1 311bb865323017a4a42e27f8bc71cae705c07c01
SHA512 b9369ee26a75c8099725b941ebb8ebb9c7e144999544ddcc9e2a1ab6f0d357ea8c3161b18b0b1043cc16bc70d999a44a7135e2be606bd4eaef570cb6011fc92f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1800	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1800	1168	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c2b5ba377b96092d2ecb85b737ab83cb93645e92ae3d1afaf0a7e971755284f7.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1800

memory/1168-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

Download

memory/1800-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1800-57-0x00000000001C1000-0x00000000001E3000-memory.dmp

Download

memory/1800-58-0x00000000001C0000-0x00000000001E7000-memory.dmp

Download