emotet | 1b362e2acd61e86295776c375aaafb54ebead681670cdd0afde0573b4cfd4cfe

Analysis

Target
a36324f186243909594f8198e1653c4f.dll
Size 524KB
Sample220706-cazahshda2
SHA256 1b362e2acd61e86295776c375aaafb54ebead681670cdd0afde0573b4cfd4cfe
MD5 a36324f186243909594f8198e1653c4f
SHA1 5280d4697b43618a14b6f196d130842602bfed68
SHA512 bb346ee496b5ad5a561c2df522b472ddbefcb7b1e214e354bf9262f27c9efce7ca0d4b391b37ae164e423fa8487724afe6bb0fd57d6ed0675a47890dbcd764bd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1632	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1980	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1980	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1980	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1980	1632	regsvr32.exe	28
PID 1632 wrote to memory of 1980	1632	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a36324f186243909594f8198e1653c4f.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NgmCIC\qukgBDTlstTje.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

memory/1632-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download

memory/1632-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download