emotet | 9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1

Analysis

Target
emotet_exe_e5_9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1_2021-12-10__000353.exe.dll
Size 258KB
Sample211210-acmcmaeff8
SHA256 9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1
MD5 14da23d8f25c9082f7c9643f47f20ad8
SHA1 a87551ee0bdf33655a0bd8be323ad07df4c736d7
SHA512 ee2c46e8d1401cfa41927b2bad6a32d66fb8559a0a6c1b5d58d6045b5930a6cb3fb2080786a365dcfd861bc32c553f487c8e2c201abc2b78b2815c77a853ce36
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1_2021-12-10__000353.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1_2021-12-10__000353.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9677bcb4932280d87f162e3e71e8a1f1db6c3d8891da685df90e87c59aa0aab1_2021-12-10__000353.exe.dll",DllRegisterServer
    3⤵
    PID:1452

memory/1636-56-0x0000000076421000-0x0000000076423000-memory.dmp

Download

memory/1636-59-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1684-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download