emotet | cd28b2a13607116e382818127f7ca3804e372f7433b329fe69121e108dbbf3fc

Analysis

Target
2c11a5e883c420f2d8dd8bab23e9fe3c.dll
Size 704KB
Sample220331-mrnkfsafa5
SHA256 cd28b2a13607116e382818127f7ca3804e372f7433b329fe69121e108dbbf3fc
MD5 2c11a5e883c420f2d8dd8bab23e9fe3c
SHA1 2ec12697a46575c0a0f16f2e4e12c2f18d2caf80
SHA512 35b34b616fe0ed659b5a21da2c134acd50c358b68537e3dc9922da697cbcdb2cf8337c1579b78984b9f14e69d071bdf94ef0dd7f55673a6f43d42855bb629e4c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
792	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27
PID 1560 wrote to memory of 792	1560	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2c11a5e883c420f2d8dd8bab23e9fe3c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2c11a5e883c420f2d8dd8bab23e9fe3c.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:792

memory/792-56-0x0000000076361000-0x0000000076363000-memory.dmp

Download

memory/792-57-0x0000000000190000-0x00000000001B3000-memory.dmp

Download

memory/1560-54-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmp

Download