emotet | 81847a7a4947c8642038e7816a1f67c27b6dfefc967f4d0cf709b94d4f97913a

Analysis

Target
f4e094d0c3b2189ec8a0da45271cd297.dll
Size 704KB
Sample220331-l5mpmsabf2
SHA256 81847a7a4947c8642038e7816a1f67c27b6dfefc967f4d0cf709b94d4f97913a
MD5 f4e094d0c3b2189ec8a0da45271cd297
SHA1 648dcfe536195fe07ffb7bb9c959c083280174fa
SHA512 a686cae256f49f7f5a72a5a274c50a6f7bd278d77ec96d9740152c6428fbf863eaa6d3804ab300c5aae95de0f268c686b9a26e6a0f2d21ed9b37b8d70643b690
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1868	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27
PID 792 wrote to memory of 1868	792	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f4e094d0c3b2189ec8a0da45271cd297.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f4e094d0c3b2189ec8a0da45271cd297.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

memory/792-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Download

memory/1868-56-0x00000000758A1000-0x00000000758A3000-memory.dmp

Download

memory/1868-57-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download