emotet | 16fe23680fa41df6cf3d0f40297347362a77610ebf372b5bd47abe858abf4a9e

Analysis

Target
e127069cd8adb6abf24db27971fbf8d7.dll
Size 432KB
Sample220401-m989waagg8
SHA256 16fe23680fa41df6cf3d0f40297347362a77610ebf372b5bd47abe858abf4a9e
MD5 e127069cd8adb6abf24db27971fbf8d7
SHA1 8d7aa7eb66a00253d1c3e90b697dc69997a4ac81
SHA512 7426374f8bed1c955a3a4093d3f540b92f8dce201fdfb253d64a0954b365485ab7d03bf7352ad7c1b9e2ad9dac98e4b2f5a1cd6b261626040bbdc24a6efc48b5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1380	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27
PID 588 wrote to memory of 1380	588	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e127069cd8adb6abf24db27971fbf8d7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e127069cd8adb6abf24db27971fbf8d7.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380

memory/588-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download

memory/1380-56-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/1380-57-0x0000000000460000-0x0000000000483000-memory.dmp

Download