emotet | 6c1c536454a04838796b2ea2f2f7cdf2b32dc417ecf10d0479ec1c3b8ed4a1af

Analysis

Target
emotet_exe_e5_6c1c536454a04838796b2ea2f2f7cdf2b32dc417ecf10d0479ec1c3b8ed4a1af_2022-03-24__220307.dll
Size 608KB
Sample220324-1yy7esfac7
SHA256 6c1c536454a04838796b2ea2f2f7cdf2b32dc417ecf10d0479ec1c3b8ed4a1af
MD5 93c99691a86aa264ed881827ff241d2b
SHA1 b667f357a550fe84c73fe2903e0687f2d78513ca
SHA512 417d0bb6f8f22a95b9120629ed3fedaaa54328de23ec4a382c79fe719c0f5c17c29ba782eaeb1a1d52375059c89f91fa961ef50612034caac4885b4f65978023
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
804	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27
PID 756 wrote to memory of 804	756	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6c1c536454a04838796b2ea2f2f7cdf2b32dc417ecf10d0479ec1c3b8ed4a1af_2022-03-24__220307.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6c1c536454a04838796b2ea2f2f7cdf2b32dc417ecf10d0479ec1c3b8ed4a1af_2022-03-24__220307.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804

memory/756-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Download

memory/804-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download

memory/804-57-0x0000000000170000-0x0000000000193000-memory.dmp

Download