emotet | af036e29bc569f68fd71c49aae2ab0753a908393a239e0158a13dc0468f939bc

Analysis

Target
emotet_exe_e4_af036e29bc569f68fd71c49aae2ab0753a908393a239e0158a13dc0468f939bc_2022-03-24__164515.dll
Size 612KB
Sample220324-t91fasbfe5
SHA256 af036e29bc569f68fd71c49aae2ab0753a908393a239e0158a13dc0468f939bc
MD5 92f0d9cac18b50e750c4601516d94872
SHA1 1c26682d954273648ef405f52ec872425d73c9a6
SHA512 eefdb908814c604f747493103456cf8d626c52becd01dbf413184ee7a34814d89dc4705641c114f35b623faf4c0c6300f41f8d6df59a5de4815d61b5c2285a02
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29
PID 1496 wrote to memory of 2036	1496	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af036e29bc569f68fd71c49aae2ab0753a908393a239e0158a13dc0468f939bc_2022-03-24__164515.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af036e29bc569f68fd71c49aae2ab0753a908393a239e0158a13dc0468f939bc_2022-03-24__164515.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036

memory/1496-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download

memory/2036-56-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Download

memory/2036-58-0x00000000001D0000-0x00000000001F4000-memory.dmp

Download