emotet | cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86

Analysis

Target
emotet_exe_e4_cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86_2022-03-29__000122.dll
Size 680KB
Sample220329-abftfsghg3
SHA256 cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86
MD5 45cf45270b5c719f7b83c830c0ac6272
SHA1 3f3e23f281c1afd7a8a1700ffb85042fda752886
SHA512 851350b53b40387051389a8f9ac6122bb8d7de3f0f480a242e2c64982f649009f7d45512e3a20d95ae323bbae1dbd5a46b2a8f5ba40556cdd8fea542dc8bf8c0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3828	regsvr32.exe
3828	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3828	2732	regsvr32.exe	79
PID 2732 wrote to memory of 3828	2732	regsvr32.exe	79
PID 2732 wrote to memory of 3828	2732	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86_2022-03-29__000122.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cd986dfa2589840ee4d54fbf6bf7031fcca763056dc2a06d54ae6914aad4ac86_2022-03-29__000122.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

memory/3828-131-0x0000000002580000-0x00000000025A4000-memory.dmp

Download