emotet | 5457545ecb6891d7ab44d14e3532b77551dd7b68ab674039f5a586eba801dedb

Analysis

Target
ba3e8b5188c71ba8c89cb7a3614ad567.dll
Size 704KB
Sample220331-v8vzvsfeb3
SHA256 5457545ecb6891d7ab44d14e3532b77551dd7b68ab674039f5a586eba801dedb
MD5 ba3e8b5188c71ba8c89cb7a3614ad567
SHA1 b155197d52b4c3f424234c31c34ffcb58f692119
SHA512 692d0e1c9d93a6a26ee5cab7e6155fe95edeeac91e44464ee74fab8b014381b9937da40d7b9b2a31776ce8c1abc96be5e346b3938997c889f455a0e52c1ff56b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1556	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27
PID 740 wrote to memory of 1556	740	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba3e8b5188c71ba8c89cb7a3614ad567.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba3e8b5188c71ba8c89cb7a3614ad567.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

memory/740-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1556-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1556-57-0x0000000000200000-0x0000000000223000-memory.dmp

Download