emotet | 6b5dae840f4b6b84af53f8e879dfcff2591cd02cac2a05a150dbd2cd78bd44c9

Analysis

Target
dbe2521cbdbe8d8ceaf027b94b900778.dll
Size 580KB
Sample220605-cbjw8afeb3
SHA256 6b5dae840f4b6b84af53f8e879dfcff2591cd02cac2a05a150dbd2cd78bd44c9
MD5 dbe2521cbdbe8d8ceaf027b94b900778
SHA1 cffc4144c5a83f4535d00ecbc626be693a4a1dcf
SHA512 7b63377fe6ccbb12f42f61ac486dfe2081ffa7ec7163be185d18a6262d268fa759d19a231a2ac0c818cbffec74591cc788d95e77da5bd2b4b7159d02776573f0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
376	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
376	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1348	376	regsvr32.exe	27
PID 376 wrote to memory of 1348	376	regsvr32.exe	27
PID 376 wrote to memory of 1348	376	regsvr32.exe	27
PID 376 wrote to memory of 1348	376	regsvr32.exe	27
PID 376 wrote to memory of 1348	376	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbe2521cbdbe8d8ceaf027b94b900778.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ThDUnZDScA\gqqRncfc.dll"
  2⤵
  PID:1348

memory/376-54-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Download

memory/376-55-0x0000000001E10000-0x0000000001EBA000-memory.dmp

Download

memory/376-57-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/1348-62-0x0000000001D30000-0x0000000001DDA000-memory.dmp

Download