emotet | 28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8

Analysis

Target
emotet_exe_e4_28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8_2022-01-11__151727.exe.dll
Size 735KB
Sample220111-splwqsgcfl
SHA256 28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8
MD5 fc961477f4d59e39f13f3d4c0237a2a7
SHA1 7a7a5252f38fb2757d756fc78db9abb613e07f92
SHA512 2bc5bee4f633ec0d809f9c51b465a158c67fadcb2d2dc75e552fe7f6b43d303d097fb150a7bb68b9d9a64478b3fe4651d34148d713851ecb56c16c6579a99c34
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3796	2828	regsvr32.exe	68
PID 2828 wrote to memory of 3796	2828	regsvr32.exe	68
PID 2828 wrote to memory of 3796	2828	regsvr32.exe	68
PID 3796 wrote to memory of 1020	3796	regsvr32.exe	69
PID 3796 wrote to memory of 1020	3796	regsvr32.exe	69
PID 3796 wrote to memory of 1020	3796	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8_2022-01-11__151727.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8_2022-01-11__151727.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_28ef61ea2ad24961e3e8913ee3554b7c4d112fd35adacd105cce21c830ba80e8_2022-01-11__151727.exe.dll",DllRegisterServer
    3⤵
    PID:1020

memory/3796-117-0x0000000004AB3000-0x0000000004AB4000-memory.dmp

Download

memory/3796-116-0x0000000004A91000-0x0000000004AB3000-memory.dmp

Download