emotet | 7c7cd49cd93bf2c1203050be9fa0932ffc1c63415ac6ee725727605213e9b5f4

Analysis

Target
62c3c0073990d3268b8d397084351b40.dll
Size 539KB
Sample220714-har44aacdk
SHA256 7c7cd49cd93bf2c1203050be9fa0932ffc1c63415ac6ee725727605213e9b5f4
MD5 62c3c0073990d3268b8d397084351b40
SHA1 91557eecfb3fa8987c6ddac9f2d8fd7cd6bdf1b6
SHA512 028bc6862cf57bc10766e3d384de4605d8e69bc629de0dd281877d08f9d8931c2ff7a614bcdcb4caade01d58896c88e00d2f53eb3b161a22ff4760c73e06b44d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1884	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1272	1884	regsvr32.exe	28
PID 1884 wrote to memory of 1272	1884	regsvr32.exe	28
PID 1884 wrote to memory of 1272	1884	regsvr32.exe	28
PID 1884 wrote to memory of 1272	1884	regsvr32.exe	28
PID 1884 wrote to memory of 1272	1884	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62c3c0073990d3268b8d397084351b40.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DROkdcirkSVP\LeYmw.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

memory/1884-54-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

Download

memory/1884-55-0x0000000000410000-0x000000000046D000-memory.dmp

Download