emotet | e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b

Analysis

Target
emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
Size 258KB
Sample211209-bnfvnaach3
SHA256 e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b
MD5 d574e8dfcb34731a09ca02bdaec35e78
SHA1 a1511f4fad6c92689a8bb42de37c168fcfee3a74
SHA512 40420d300fd1c2641e7447dd45640740033a0c788d5cfab31a1b45f42be192f5ef20310f2a256a79e3b9fd93972d065abcd975aae98ab936bcc00f2812023b1b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 836 wrote to memory of 1592	836	regsvr32.exe	27
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1272	1592	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll",DllRegisterServer
    3⤵
    PID:1272

memory/836-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download

memory/1592-56-0x0000000076421000-0x0000000076423000-memory.dmp

Download

memory/1592-59-0x0000000010000000-0x0000000010025000-memory.dmp

Download