emotet | 19d2de36a8e46c8daa8f32e44cbd08a089b23988e888994f7ff6b2ba79396495

Analysis

Target
emotet_exe_e5_19d2de36a8e46c8daa8f32e44cbd08a089b23988e888994f7ff6b2ba79396495_2022-03-25__003124.dll
Size 494KB
Sample220325-avmfcahcc5
SHA256 19d2de36a8e46c8daa8f32e44cbd08a089b23988e888994f7ff6b2ba79396495
MD5 279fd595b3a91ad9242ad92dd7ef1791
SHA1 65a712b638bdc62b2feaf92abe4cca0121ff1659
SHA512 df24815f39925aa087f815acad5456b3e866dfaf8227bcfbfd229ce89549f5c51558808c3199e0bc460e6ba0edc001eb4a2a2ebb85138f95a03366e68dceacd9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	regsvr32.exe
1816	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1816	1620	regsvr32.exe	80
PID 1620 wrote to memory of 1816	1620	regsvr32.exe	80
PID 1620 wrote to memory of 1816	1620	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_19d2de36a8e46c8daa8f32e44cbd08a089b23988e888994f7ff6b2ba79396495_2022-03-25__003124.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_19d2de36a8e46c8daa8f32e44cbd08a089b23988e888994f7ff6b2ba79396495_2022-03-25__003124.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816

memory/1816-131-0x0000000010000000-0x0000000010027000-memory.dmp

Download