emotet | ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155

Analysis

Target
emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
Size 262KB
Sample211209-bcn2wsacc5
SHA256 ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155
MD5 573eabd987172fed6aa1e710bdc57b14
SHA1 2a2c16d3ebf6aace0b976b0ce0b21329f09f20b5
SHA512 2872b9359389ec01570a347a58c2e9924fc6fd580d1fb1426dc57e8e81813120dc797e18c277aca73fe65123952a0244f81dc346afad7486844408da9b39ee35
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1772 wrote to memory of 1184	1772	regsvr32.exe	27
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28
PID 1184 wrote to memory of 764	1184	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll",DllRegisterServer
    3⤵
    PID:764

memory/1184-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1184-59-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1772-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download