emotet | 2577b1e6e13f2ee42f5c2e765cd92b658716e6b0ac3d50c8cb4cab8512ed7a4b

Analysis

Target
emotet_exe_e4_0887e73d4d665231172c0ccad220f578e47b15e7516dfa008100d5851c0314cd_2022-04-26__083814.dll
Size 640KB
Sample220426-kj93dabff9
SHA256 2577b1e6e13f2ee42f5c2e765cd92b658716e6b0ac3d50c8cb4cab8512ed7a4b
MD5 03bf6a7198e4ad42979adbd5134b0003
SHA1 704e291fb6f656267abb33bdbf6cf22bec43b4ba
SHA512 65a412d6b8b2d1964c20c06ea1abdb3dddac3a94878a836332274618ecb88651f0cb0ee7ec60881341352d739103211dc16e88e2be8805ee1fb8b229bba92c22
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	regsvr32.exe
1964	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1964	2420	regsvr32.exe	83
PID 2420 wrote to memory of 1964	2420	regsvr32.exe	83
PID 2420 wrote to memory of 1964	2420	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0887e73d4d665231172c0ccad220f578e47b15e7516dfa008100d5851c0314cd_2022-04-26__083814.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0887e73d4d665231172c0ccad220f578e47b15e7516dfa008100d5851c0314cd_2022-04-26__083814.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

memory/1964-131-0x0000000010000000-0x0000000010028000-memory.dmp

Download