emotet | 44b8894eacebf7ea94867da07b84e3ad8d092472d19bbc8efdace71a52a3240b

Analysis

Target
emotet_exe_e5_44b8894eacebf7ea94867da07b84e3ad8d092472d19bbc8efdace71a52a3240b_2022-03-24__040204.dll
Size 611KB
Sample220324-emcy6abhe2
SHA256 44b8894eacebf7ea94867da07b84e3ad8d092472d19bbc8efdace71a52a3240b
MD5 e2b527c6ebd97223ac6ad106384c3b9a
SHA1 6a85c22df8faf496396a3bb2d8615f217b96a3bc
SHA512 cccc2cac701b3eed8b4c0b2a3242ff549f546397837c22d8636ba0aa96a38e63590a5e15c4c27e34cbd79294417fef26a0515979b8fa8fc0e926df48b70b727a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	regsvr32.exe
4596	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4596	4640	regsvr32.exe	83
PID 4640 wrote to memory of 4596	4640	regsvr32.exe	83
PID 4640 wrote to memory of 4596	4640	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_44b8894eacebf7ea94867da07b84e3ad8d092472d19bbc8efdace71a52a3240b_2022-03-24__040204.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_44b8894eacebf7ea94867da07b84e3ad8d092472d19bbc8efdace71a52a3240b_2022-03-24__040204.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

memory/4596-135-0x0000000010000000-0x0000000010027000-memory.dmp

Download