emotet | 16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0

Analysis

Target
emotet_exe_e4_16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0_2021-12-03__123348.exe.dll
Size 1.1MB
Sample211203-psb9xsbee3
SHA256 16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
MD5 2f93cb3701205b257b8ef5e76545923b
SHA1 c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA512 2c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3688	3056	regsvr32.exe	68
PID 3056 wrote to memory of 3688	3056	regsvr32.exe	68
PID 3056 wrote to memory of 3688	3056	regsvr32.exe	68
PID 3688 wrote to memory of 4024	3688	regsvr32.exe	69
PID 3688 wrote to memory of 4024	3688	regsvr32.exe	69
PID 3688 wrote to memory of 4024	3688	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0_2021-12-03__123348.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0_2021-12-03__123348.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0_2021-12-03__123348.exe.dll",DllRegisterServer
    3⤵
    PID:4024

memory/3688-120-0x0000000010000000-0x0000000010027000-memory.dmp

Download