emotet | 82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2

Analysis

Target
emotet_exe_e4_82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2_2022-03-26__104154.dll
Size 585KB
Sample220326-mrrbcabff6
SHA256 82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2
MD5 37f36367439aa134bd8cbbe051e2610b
SHA1 7bf65d4b1440bfbe0458bffbf3c1021038ced9b0
SHA512 f267ecd50954a6b64bf84c986cefec9c37701f0b1763d75afedd31e818fd54e7fee6c13a01f645f6aa73587239e0a586871a793eb5c8eeda48362a9a87414d0e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
308	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27
PID 1776 wrote to memory of 308	1776	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2_2022-03-26__104154.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_82a934192bfb517e035a593d03f659b3324ffa5b903ca59a2a0c1d3d3f6f47a2_2022-03-26__104154.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:308

memory/308-56-0x0000000075C41000-0x0000000075C43000-memory.dmp

Download

memory/308-57-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1776-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Download