emotet | 672a606f4b1d83bcd2ca9b8164f636f47d6fa37a4fc7f486d0522f86f70a0e13

Analysis

Target
emotet_exe_e4_672a606f4b1d83bcd2ca9b8164f636f47d6fa37a4fc7f486d0522f86f70a0e13_2022-03-24__000019.dll
Size 956KB
Sample220324-aawtaabbg2
SHA256 672a606f4b1d83bcd2ca9b8164f636f47d6fa37a4fc7f486d0522f86f70a0e13
MD5 3b259a40849edd0801a1bdf737bff5ed
SHA1 88ee5e93c73f7cdaadf19fce24dc07e02794a3c0
SHA512 36d3847cb8846d2e9e9f3fd530f5723277273cbd09b2cd0a07ca379c3d5b0bf71af9d6e217baa6795972cf2f1a7bd9f10d0bee0d415be6eafdf0457293b9a84e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	regsvr32.exe
4112	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4112	5052	regsvr32.exe	83
PID 5052 wrote to memory of 4112	5052	regsvr32.exe	83
PID 5052 wrote to memory of 4112	5052	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_672a606f4b1d83bcd2ca9b8164f636f47d6fa37a4fc7f486d0522f86f70a0e13_2022-03-24__000019.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_672a606f4b1d83bcd2ca9b8164f636f47d6fa37a4fc7f486d0522f86f70a0e13_2022-03-24__000019.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

memory/4112-135-0x0000000002770000-0x0000000002794000-memory.dmp

Download