emotet | ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4

Analysis

Target
emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
Size 735KB
Sample220111-splwqsgcfm
SHA256 ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4
MD5 26f956b7c9fa72b791c24f28ec03aa7b
SHA1 83377740b87d44c3f5682cc6e7bf828093eb78f6
SHA512 1506926d1c24e4732ec29b3fcf05ab95c1c943a69a6c74ffc3681c1f56f59cf9eef8ba23722299171dacedd24d76d5372c0b15d458e8f6f20a7dcab9ec52f97f
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 960 wrote to memory of 1712	960	regsvr32.exe	27
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28
PID 1712 wrote to memory of 780	1712	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll",DllRegisterServer
    3⤵
    PID:780

memory/960-53-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1712-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1712-56-0x0000000000771000-0x0000000000793000-memory.dmp

Download

memory/1712-57-0x0000000000793000-0x0000000000794000-memory.dmp

Download