emotet | 500360b208379d580b9a1e2cb74fa33abb47237a4e929355bdeab9f61fe35d35

Analysis

Target
c14d173e4980b42f9a1cfd87422d30f0.dll
Size 826KB
Sample220609-cmt7bsfcc4
SHA256 500360b208379d580b9a1e2cb74fa33abb47237a4e929355bdeab9f61fe35d35
MD5 c14d173e4980b42f9a1cfd87422d30f0
SHA1 562bc536223393d2d27819a93bf25ee3dea2031e
SHA512 df2a23355f4c5e8bb1beed017d1947650f9ccc52fb8a0b87542635029e9e27f75c60389e6721f5429e8b1bfb46ac715aae3a1bf1c2bd5db9e09713ce14fbdde7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1032	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2028	1032	regsvr32.exe	27
PID 1032 wrote to memory of 2028	1032	regsvr32.exe	27
PID 1032 wrote to memory of 2028	1032	regsvr32.exe	27
PID 1032 wrote to memory of 2028	1032	regsvr32.exe	27
PID 1032 wrote to memory of 2028	1032	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c14d173e4980b42f9a1cfd87422d30f0.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LgcfIal\NKcKpq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

memory/1032-54-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Download

memory/1032-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download