emotet | bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af

Analysis

Target
emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll
Size 258KB
Sample211224-cjzbwacba2
SHA256 bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af
MD5 c65a94937f722e40575638479887427a
SHA1 7bce6681dbaab416ec780b6e04db3c7bea7e251e
SHA512 9e00cdfdd114c5922a329dd8507210a5c91887b96b9f6008a2351772568872d4b6091118b177383561105c8843216ff96f4b5029c65107a0617c0ee690ef2e9e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2760	2684	regsvr32.exe	68
PID 2684 wrote to memory of 2760	2684	regsvr32.exe	68
PID 2684 wrote to memory of 2760	2684	regsvr32.exe	68
PID 2760 wrote to memory of 3128	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3128	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3128	2760	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bd8f9a106ac22cf1fe69baeead4f6aa01d198d1e7c3709686aeee56cc493a3af_2021-12-24__020617.exe.dll",DllRegisterServer
    3⤵
    PID:3128

memory/2760-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download