emotet | bbd6e47375668bc498165265680dc48c7581887591d0559b5dcf9ccbc68ee055

Analysis

Target
6caddd421cd629567a4cf9a4e85e532c.dll
Size 522KB
Sample220612-dfkvrabdar
SHA256 bbd6e47375668bc498165265680dc48c7581887591d0559b5dcf9ccbc68ee055
MD5 6caddd421cd629567a4cf9a4e85e532c
SHA1 880e27c3a43c27554f6f9f6437ed9da1bb66f3a3
SHA512 8942a01ec92c1dc0e366c79fc8b687f5b18b9b8032e4ebf2b5c4cefcbfb2abe7c6acc271afa2bdd53f7e2848dadd5d36afbbefacbae4bcd721839da950084e03
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

ecs1.plain

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
908	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 276	908	regsvr32.exe	28
PID 908 wrote to memory of 276	908	regsvr32.exe	28
PID 908 wrote to memory of 276	908	regsvr32.exe	28
PID 908 wrote to memory of 276	908	regsvr32.exe	28
PID 908 wrote to memory of 276	908	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6caddd421cd629567a4cf9a4e85e532c.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ORgMRlF\RiCJl.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:276

memory/908-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Download

memory/908-55-0x0000000180000000-0x000000018002B000-memory.dmp

Download