emotet | f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a

Analysis

Target
emotet_exe_e5_f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a_2021-12-07__000627.exe.dll
Size 749KB
Sample211207-aebnxaadc5
SHA256 f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a
MD5 6386cbb5ab85dcae8c018a819a506aac
SHA1 64ae412f6aeec220eb510fd9c221a2166930f4ea
SHA512 9d697d29c2c45a4a81df720566b713ac9c55f331f83ca6b7a17a48443a949045880af27aa5e03b19c3f2958b415eca7c1890249d983ee323e1300fc2892b6b3c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2680	3560	regsvr32.exe	68
PID 3560 wrote to memory of 2680	3560	regsvr32.exe	68
PID 3560 wrote to memory of 2680	3560	regsvr32.exe	68
PID 2680 wrote to memory of 1904	2680	regsvr32.exe	69
PID 2680 wrote to memory of 1904	2680	regsvr32.exe	69
PID 2680 wrote to memory of 1904	2680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a_2021-12-07__000627.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a_2021-12-07__000627.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f028117976f4eec91f49f4e576b86ef5fec9977c5be5e6f08dff1b706e03881a_2021-12-07__000627.exe.dll",DllRegisterServer
    3⤵
    PID:1904

memory/2680-119-0x0000000010000000-0x0000000010025000-memory.dmp

Download