emotet | ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3

Analysis

Target
emotet_exe_e5_ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3_2021-12-09__000113.exe.dll
Size 258KB
Sample211209-abg2hsaad7
SHA256 ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3
MD5 2e4d287ed3ebf2b6c66f994dab440e79
SHA1 e1a4fd71c6d2beb6077b50b57cd498074008803d
SHA512 b5d7889139f5782c7160ca8c81d2b44e9105c2f7900f79da6feaf3f8c2c732b80f695d3d55da3bce2fb83c62ce4e1caa88874ca904209e59c9369e9adb522659
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2732	2720	regsvr32.exe	68
PID 2720 wrote to memory of 2732	2720	regsvr32.exe	68
PID 2720 wrote to memory of 2732	2720	regsvr32.exe	68
PID 2732 wrote to memory of 3240	2732	regsvr32.exe	69
PID 2732 wrote to memory of 3240	2732	regsvr32.exe	69
PID 2732 wrote to memory of 3240	2732	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3_2021-12-09__000113.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3_2021-12-09__000113.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ae6e7c4580ac8ea30db6bf460f75a82af041350343e1742e1e0f548236b2aee3_2021-12-09__000113.exe.dll",DllRegisterServer
    3⤵
    PID:3240

memory/2732-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download