emotet | 6bb5c6843c9723b2760105701db488dd7b64d20fc2aee06d76261e9050073849

Analysis

Target
b6350a51e830737a6116314d689fc212.dll
Size 755KB
Sample220705-kya7lahee5
SHA256 6bb5c6843c9723b2760105701db488dd7b64d20fc2aee06d76261e9050073849
MD5 b6350a51e830737a6116314d689fc212
SHA1 cf441e9114e5fcfcf1724e1634541a176f6f4f0d
SHA512 e69ceae61ef840d0a0b02df7620f7e394aabcff395afc67695c131eaf3a808b9abda800bf1ca4d0e993a7e331a4eac9eeec8d809b27fbefdae806be75949ab09
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
908	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1932	908	regsvr32.exe	27
PID 908 wrote to memory of 1932	908	regsvr32.exe	27
PID 908 wrote to memory of 1932	908	regsvr32.exe	27
PID 908 wrote to memory of 1932	908	regsvr32.exe	27
PID 908 wrote to memory of 1932	908	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b6350a51e830737a6116314d689fc212.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NIstomkGfeDy\myQwKtTmgNgD.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

memory/908-54-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Download

memory/908-55-0x0000000180000000-0x000000018002D000-memory.dmp

Download