emotet | c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce

Analysis

Target
emotet_exe_e5_c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce_2021-12-07__162610.exe.dll
Size 1.3MB
Sample211207-tx31naedb9
SHA256 c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce
MD5 1593d91c50af494567f069bf2955737d
SHA1 f26a1a8ef1119f031839b0314f5c41b2cb32c6b9
SHA512 1c0bd9b4c8ae8de509c765d360105cd1294bd871ef075e747a9de5d508bb195e754982cb964473a9ff93dc744db7b22fe1505080101e0e83942815dac7ae8ec8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3056	2824	regsvr32.exe	68
PID 2824 wrote to memory of 3056	2824	regsvr32.exe	68
PID 2824 wrote to memory of 3056	2824	regsvr32.exe	68
PID 3056 wrote to memory of 1620	3056	regsvr32.exe	69
PID 3056 wrote to memory of 1620	3056	regsvr32.exe	69
PID 3056 wrote to memory of 1620	3056	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce_2021-12-07__162610.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce_2021-12-07__162610.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c52d2c079bd342fee63f3a3a42ef30b430ad0a54a6059339b2267e96160cd6ce_2021-12-07__162610.exe.dll",DllRegisterServer
    3⤵
    PID:1620

memory/3056-117-0x0000000004670000-0x0000000004695000-memory.dmp

Download