emotet | 9b3afd4367d9e98b4da3d46c036dc2bdcf2924511e2727b1dbe1472d6349d68e

Analysis

Target
24553bde0bf273131fefa29cd9a18782.dll
Size 704KB
Sample220331-ve4pxafaa8
SHA256 9b3afd4367d9e98b4da3d46c036dc2bdcf2924511e2727b1dbe1472d6349d68e
MD5 24553bde0bf273131fefa29cd9a18782
SHA1 f8a750408a4e146d398f98c1660c31163563e3fb
SHA512 bf61656da90b3541000ed1420dd3efd90a646c55d514b15e23e2e9a84097fb48cbc10a7723221a3556f9fc295f7ec14eed1010c16d0a8a6e5297bf7e7356a24c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1612	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27
PID 1168 wrote to memory of 1612	1168	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24553bde0bf273131fefa29cd9a18782.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24553bde0bf273131fefa29cd9a18782.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

memory/1168-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download

memory/1612-56-0x00000000759B1000-0x00000000759B3000-memory.dmp

Download

memory/1612-57-0x0000000000360000-0x0000000000383000-memory.dmp

Download