emotet | f4eb60aca8b7ae0a17ba0ff2c3af4bbf8a01ca29d22cd09fdc2f33334c15d72a

Analysis

Target
1d328c5008a34fa0532b22c57d0a4685.dll
Size 704KB
Sample220331-lvgewaaab2
SHA256 f4eb60aca8b7ae0a17ba0ff2c3af4bbf8a01ca29d22cd09fdc2f33334c15d72a
MD5 1d328c5008a34fa0532b22c57d0a4685
SHA1 8fdd52c4881d61a51b572e369aedca733619892c
SHA512 92db256ed74a20259fc631500072bb9ce0d3b3997b5e012e096c3efd8c4635f11c529921824c89a04b320ea46ada7a470ef54886d48cf73545e1446dcb03ff05
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1984	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1984	2000	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1d328c5008a34fa0532b22c57d0a4685.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1d328c5008a34fa0532b22c57d0a4685.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

memory/1984-56-0x0000000074C61000-0x0000000074C63000-memory.dmp

Download

memory/1984-57-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download

memory/2000-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Download