emotet | ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155

Analysis

Target
emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
Size 262KB
Sample211209-bcn2wsacc5
SHA256 ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155
MD5 573eabd987172fed6aa1e710bdc57b14
SHA1 2a2c16d3ebf6aace0b976b0ce0b21329f09f20b5
SHA512 2872b9359389ec01570a347a58c2e9924fc6fd580d1fb1426dc57e8e81813120dc797e18c277aca73fe65123952a0244f81dc346afad7486844408da9b39ee35
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2680	2652	regsvr32.exe	68
PID 2680 wrote to memory of 3800	2680	regsvr32.exe	69
PID 2680 wrote to memory of 3800	2680	regsvr32.exe	69
PID 2680 wrote to memory of 3800	2680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ac2dfca8f482a96ef4fdfbc8152767f2b414c374863f26137dcc329880678155_2021-12-09__005902.exe.dll",DllRegisterServer
    3⤵
    PID:3800

memory/2680-117-0x0000000010000000-0x0000000010027000-memory.dmp

Download