emotet | 8deeba325170e56809b3db8f7ef1dab56f5c258bd30938e1cbe75505bba038d1

Analysis

Target
f99748bea97cbd7d5bc88c4f92edd25d.dll
Size 880KB
Sample220324-jsrrqaebc3
SHA256 8deeba325170e56809b3db8f7ef1dab56f5c258bd30938e1cbe75505bba038d1
MD5 f99748bea97cbd7d5bc88c4f92edd25d
SHA1 fa6d20e8ee55bf18a1ecce16a270fbd398b89be6
SHA512 88f39459f1832c6abe5e9de4ddcd0b292bddb607be475249bfcfbedae17a0ef3d0666d2694518570e2c851f598199c8b17a72f6a9aa1e7e9e3e3ab131f9d5847
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27
PID 1800 wrote to memory of 1808	1800	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f99748bea97cbd7d5bc88c4f92edd25d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f99748bea97cbd7d5bc88c4f92edd25d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808

memory/1800-54-0x000007FEFB551000-0x000007FEFB553000-memory.dmp

Download

memory/1808-56-0x0000000075081000-0x0000000075083000-memory.dmp

Download

memory/1808-58-0x0000000000200000-0x0000000000224000-memory.dmp

Download