emotet | 8a26ad87c2dbfb546a5c5b653afb5bd591b08aae3fc2d35092b3a6201943c413

Analysis

Target
c1299305f4e796ab3d34ffeae5cc41e0.dll
Size 580KB
Sample220605-cb4xdsfeb6
SHA256 8a26ad87c2dbfb546a5c5b653afb5bd591b08aae3fc2d35092b3a6201943c413
MD5 c1299305f4e796ab3d34ffeae5cc41e0
SHA1 53f5220d387a237f580e895d888b98b44b32921f
SHA512 49d9e0f202a2660283fff92cebf4eba293941575c7525f1785dbef10431230cdf7542618dc99b5a6cb7b84be898da7bbe046695be78f0f346794bb3b82a81c5a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
936	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
936	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2044	936	regsvr32.exe	28
PID 936 wrote to memory of 2044	936	regsvr32.exe	28
PID 936 wrote to memory of 2044	936	regsvr32.exe	28
PID 936 wrote to memory of 2044	936	regsvr32.exe	28
PID 936 wrote to memory of 2044	936	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c1299305f4e796ab3d34ffeae5cc41e0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NWmjYVP\hVaUxN.dll"
  2⤵
  PID:2044

memory/936-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/936-55-0x0000000000440000-0x00000000004EA000-memory.dmp

Download

memory/936-57-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/2044-62-0x0000000001D10000-0x0000000001DBA000-memory.dmp

Download