emotet | 1127fc8e220794d7ec6fdaecb29194cc9a7a3eea9319ffb3c1a39b82dfd32acf

Analysis

Target
WOXM0YpQWOXVc.dll
Size 314KB
Sample220623-zmkdfsfcdn
SHA256 1127fc8e220794d7ec6fdaecb29194cc9a7a3eea9319ffb3c1a39b82dfd32acf
MD5 a98a89114b5fb67a0870c7a5bd213bac
SHA1 06cba579205ee81f5cce02f1ee02bf1bde0c0b27
SHA512 038584b6d37064b855905d174491ee3d091af5e10b1f5f2ee11657b4249308072449e4d6bfda71b3789aef1f134131f0d0d42ace31402e39e74920f54c02cda6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1672	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2724	1672	regsvr32.exe	77
PID 1672 wrote to memory of 2724	1672	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\WOXM0YpQWOXVc.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VToiMLWKq\lPEUmAXXoR.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

memory/1672-130-0x0000000000650000-0x000000000067A000-memory.dmp

Download