emotet | e3ae2d69fc11f8db26f6185880422d6f9a81d83c4fe875206ea80a1f553c4e64

Analysis

Target
e3ae2d69fc11f8db26f6185880422d6f9a81d83c4fe875206ea80a1f553c4e64.dll
Size 684KB
Sample220323-pk7e4aeaa2
SHA256 e3ae2d69fc11f8db26f6185880422d6f9a81d83c4fe875206ea80a1f553c4e64
MD5 af5eeb6d46ed66c12d545eb5a4b9402f
SHA1 7da10dacafa0ff0e496911e7913d68a9df5a0be2
SHA512 3c82611881a97ed617b6b8d3934fb56a72e791bfffd997448b9a24af8ff21679ea963d46388b6f2bca8d6ae58710e8b58f1037dbf3731a768bf1d9c078c13d0f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
580	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27
PID 1180 wrote to memory of 580	1180	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e3ae2d69fc11f8db26f6185880422d6f9a81d83c4fe875206ea80a1f553c4e64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e3ae2d69fc11f8db26f6185880422d6f9a81d83c4fe875206ea80a1f553c4e64.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:580

memory/580-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/580-58-0x00000000001F0000-0x0000000000217000-memory.dmp

Download

memory/1180-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download