emotet | 96375377d7a1b3e91aebb3d093eb7647a4a104ab7b64cf2ed3b0bac624ea0e73

Analysis

Target
64a14bb31ed32a3b501c457f5cc4e77f.dll
Size 524KB
Sample220706-bdsrgafaem
SHA256 96375377d7a1b3e91aebb3d093eb7647a4a104ab7b64cf2ed3b0bac624ea0e73
MD5 64a14bb31ed32a3b501c457f5cc4e77f
SHA1 ac2d2bb1be0e5528f889eb7bc70231699a593679
SHA512 b2f7afe5456083c5c835532ecc2271b160d46a2f279f16e425e70325c9bbbca0a6455e5a5db1111d0a67d1532e76ee0a1c9d57fc375e086c5a9f51caa3074a29
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1096	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1736	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1736	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1736	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1736	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1736	1096	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64a14bb31ed32a3b501c457f5cc4e77f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BXdokiQRRa\TSyIIGBCn.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

memory/1096-54-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp

Download

memory/1096-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download