emotet | b1ea6dfcf37b87ec63ae245b21d9ba63c1dd716b8e58bcd32e5617a02f9c205c

Analysis

Target
e47ea524edb55ffe17734fea5816eb2a.dll
Size 577KB
Sample220610-wpqfpseabp
SHA256 b1ea6dfcf37b87ec63ae245b21d9ba63c1dd716b8e58bcd32e5617a02f9c205c
MD5 e47ea524edb55ffe17734fea5816eb2a
SHA1 898529c48c44e2f8004fb3071ead5486b73bda82
SHA512 475a20c057e0197104cfc8b15f4ec85380b939c452d6dddc3364dbcc38cf39caef7d654a11eb453864b47507394e02d515b21f58d23ae1c6d50e7471ac731764
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
884	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
884	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1480	884	regsvr32.exe	27
PID 884 wrote to memory of 1480	884	regsvr32.exe	27
PID 884 wrote to memory of 1480	884	regsvr32.exe	27
PID 884 wrote to memory of 1480	884	regsvr32.exe	27
PID 884 wrote to memory of 1480	884	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e47ea524edb55ffe17734fea5816eb2a.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DNXYSFiEUz\neUwijyMgP.dll"
  2⤵
  PID:1480

memory/884-54-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Download

memory/884-55-0x0000000001C70000-0x0000000001D1A000-memory.dmp

Download

memory/884-57-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/1480-62-0x0000000001E60000-0x0000000001F0A000-memory.dmp

Download