emotet | 38d65f233c5f975c197762cc6df4fd2e016d7b2d4511fc6801742c4026bbcf0e

Analysis

Target
b89dca2b8c3b12847151e90f585fd6ec.dll
Size 847KB
Sample220707-axb3dsdbc5
SHA256 38d65f233c5f975c197762cc6df4fd2e016d7b2d4511fc6801742c4026bbcf0e
MD5 b89dca2b8c3b12847151e90f585fd6ec
SHA1 15e7a8ea80a584944f387052d42eb83a0f5aa76f
SHA512 34e4072da1c4c5a10aca640dd2237733a11fdfd121b167c3fde2afa19f09de9289114cf7038e5eff18e5719b3c34425b67e0c49873f5d3c6d1328885454f61cb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2784	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2352	2784	regsvr32.exe	80
PID 2784 wrote to memory of 2352	2784	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b89dca2b8c3b12847151e90f585fd6ec.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ViNeWfmFHlhgq\edqAUZPRrNvHxvq.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352

memory/2784-130-0x0000000180000000-0x0000000180030000-memory.dmp

Download