emotet | cfed078f7cc8691bfff675c5d20c32f9b27094df345a4223587a7bbd9eec8a43

Analysis

Target
b05bc684e3262b067aa7b844b024fc22.dll
Size 705KB
Sample220714-har44adcc8
SHA256 cfed078f7cc8691bfff675c5d20c32f9b27094df345a4223587a7bbd9eec8a43
MD5 b05bc684e3262b067aa7b844b024fc22
SHA1 52947cf5cb6639f37841c1292083ba64b24afb3a
SHA512 fec85240a5807f9cdf50e7323e69b49577dae2b677a71967f029b8e5698a462391863c49c945905ad79fea7cce92e1e927a188d6665a8481c95d075d5f275812
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2672	regsvr32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4848	2672	regsvr32.exe	82
PID 2672 wrote to memory of 4848	2672	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b05bc684e3262b067aa7b844b024fc22.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AixSP\IqcNVwYGxs.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

memory/2672-130-0x0000000180000000-0x000000018002B000-memory.dmp

Download