emotet | 7842265c7fa8e6c0028648bca8cf67cee8759d09dc31efe2ddec5a7135b15214

Analysis

Target
2dbe7a1457bd257cb9c0707a3075b8ec.dll
Size 432KB
Sample220401-wct85afae3
SHA256 7842265c7fa8e6c0028648bca8cf67cee8759d09dc31efe2ddec5a7135b15214
MD5 2dbe7a1457bd257cb9c0707a3075b8ec
SHA1 588c9658925cd2c576c82f8023c3e38a9ba9337e
SHA512 8c7fd1e1bc624f1fd27f20a58171d70d86733569e15555537ae04cc9990fdf00d76fbb8d3566e4cde59ad4b39a77d07b78b8513c5205b19409f96c2b7058818f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1180	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27
PID 972 wrote to memory of 1180	972	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2dbe7a1457bd257cb9c0707a3075b8ec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2dbe7a1457bd257cb9c0707a3075b8ec.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

memory/972-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/1180-56-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1180-57-0x00000000001B0000-0x00000000001D3000-memory.dmp

Download