emotet | 92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff

Analysis

Target
emotet_exe_e5_92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff_2021-12-07__162609.exe.dll
Size 1.3MB
Sample211207-tx31naedb8
SHA256 92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff
MD5 c41d2c729a232c9ad997d1a0ca6ea647
SHA1 bb57be71648fc27b98a8da0b20a8b4764c244c31
SHA512 dac556aae2306230cb0830d804013194af9f8956a2be6032c1fa32928574df2525d4cedc275c5dcef31fac5aaf226f6c0a8bf413839cd060e997c96d795925d9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 3356	3452	regsvr32.exe	68
PID 3452 wrote to memory of 3356	3452	regsvr32.exe	68
PID 3452 wrote to memory of 3356	3452	regsvr32.exe	68
PID 3356 wrote to memory of 4080	3356	regsvr32.exe	69
PID 3356 wrote to memory of 4080	3356	regsvr32.exe	69
PID 3356 wrote to memory of 4080	3356	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff_2021-12-07__162609.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff_2021-12-07__162609.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_92e4982051ded134401c04729088ef6eec885d8a7c024524f4fea6ae2e451aff_2021-12-07__162609.exe.dll",DllRegisterServer
    3⤵
    PID:4080

memory/3356-120-0x0000000003160000-0x0000000003185000-memory.dmp

Download