emotet | 45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f

Analysis

Target
emotet_exe_e4_45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f_2022-03-29__080822.dll
Size 576KB
Sample220329-j15csacgh6
SHA256 45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f
MD5 8b28f15893d623a6a5da802c466fd973
SHA1 fad242c296731f93ff564c43cf0687f93b7ddf1c
SHA512 ee33804d89583c9d82dfe775a99ace8a2dccf2e449f073dae0cfad1d1fd69b105dd318c0bea2491fa379adc43ba0c6d3b957c839b7bc5bdfd8511f2ddfbaeb73
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	regsvr32.exe
4156	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4156	4196	regsvr32.exe	80
PID 4196 wrote to memory of 4156	4196	regsvr32.exe	80
PID 4196 wrote to memory of 4156	4196	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f_2022-03-29__080822.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_45b403bad8897e855df2a689a5fcd4a9f6b902ee36ec2b0454b45d91253a879f_2022-03-29__080822.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

memory/4156-131-0x0000000002650000-0x0000000002674000-memory.dmp

Download