emotet | 5068aa134db65556b855adb993931cd05016706dd0d0f042b17ea3770488cfcd

Analysis

Target
52ce70ec1d883e956c795ccd2fbda3fb.dll
Size 365KB
Sample220522-aql9saebb9
SHA256 5068aa134db65556b855adb993931cd05016706dd0d0f042b17ea3770488cfcd
MD5 52ce70ec1d883e956c795ccd2fbda3fb
SHA1 dc31ec2bec120e1c6ec3cad30db213c71f4abc7d
SHA512 d8f1648cf85e36449c559795049f72e6284564f59ed1bd68f7935e6863df6f36045cf8a09dc623b13bcf4130c025b39310892f23ce074fcd4e8fe04c79d69bba
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28
PID 384 wrote to memory of 1708	384	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\52ce70ec1d883e956c795ccd2fbda3fb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\52ce70ec1d883e956c795ccd2fbda3fb.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

memory/384-54-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Download

memory/1708-56-0x00000000763E1000-0x00000000763E3000-memory.dmp

Download

memory/1708-57-0x0000000010000000-0x0000000010023000-memory.dmp

Download