emotet | e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b

Analysis

Target
emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
Size 258KB
Sample211209-bnfvnaach3
SHA256 e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b
MD5 d574e8dfcb34731a09ca02bdaec35e78
SHA1 a1511f4fad6c92689a8bb42de37c168fcfee3a74
SHA512 40420d300fd1c2641e7447dd45640740033a0c788d5cfab31a1b45f42be192f5ef20310f2a256a79e3b9fd93972d065abcd975aae98ab936bcc00f2812023b1b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3984	3892	regsvr32.exe	68
PID 3892 wrote to memory of 3984	3892	regsvr32.exe	68
PID 3892 wrote to memory of 3984	3892	regsvr32.exe	68
PID 3984 wrote to memory of 912	3984	regsvr32.exe	69
PID 3984 wrote to memory of 912	3984	regsvr32.exe	69
PID 3984 wrote to memory of 912	3984	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e83a83cbbb92b8b2d1158d03ce1c4fa5489c29da3349db1a33325d1adcef501b_2021-12-09__011659.exe.dll",DllRegisterServer
    3⤵
    PID:912

memory/3984-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download