emotet | fdd83a155fad80d2b4bc5e6bd7e26b4fdae8bd1d4a0369e28636f17c9e4c3f95

Analysis

Target
fdd83a155fad80d2b4bc5e6bd7e26b4fdae8bd1d4a0369e28636f17c9e4c3f95.dll
Size 684KB
Sample220323-pmx97seaf3
SHA256 fdd83a155fad80d2b4bc5e6bd7e26b4fdae8bd1d4a0369e28636f17c9e4c3f95
MD5 8da4849c31399f7fe3978a773992cc34
SHA1 9980f905f33d0cd7a00953cc24f5f20b138a9c9e
SHA512 6bacdae2bbd3e9463a0fb7255ada44acbda58ec13a3c94b537fcad5e6f81e31163c3569360d8366d2a81d0741483b95f38f169a7fc9257b8728c59426509c31e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fdd83a155fad80d2b4bc5e6bd7e26b4fdae8bd1d4a0369e28636f17c9e4c3f95.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fdd83a155fad80d2b4bc5e6bd7e26b4fdae8bd1d4a0369e28636f17c9e4c3f95.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808

memory/1800-54-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Download

memory/1808-56-0x0000000075081000-0x0000000075083000-memory.dmp

Download

memory/1808-57-0x00000000001D0000-0x00000000001F7000-memory.dmp

Download