emotet | ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4

Analysis

Target
emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
Size 735KB
Sample220111-splwqsgcfm
SHA256 ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4
MD5 26f956b7c9fa72b791c24f28ec03aa7b
SHA1 83377740b87d44c3f5682cc6e7bf828093eb78f6
SHA512 1506926d1c24e4732ec29b3fcf05ab95c1c943a69a6c74ffc3681c1f56f59cf9eef8ba23722299171dacedd24d76d5372c0b15d458e8f6f20a7dcab9ec52f97f
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3160	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3160	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3160	3068	regsvr32.exe	69
PID 3160 wrote to memory of 2504	3160	regsvr32.exe	70
PID 3160 wrote to memory of 2504	3160	regsvr32.exe	70
PID 3160 wrote to memory of 2504	3160	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ec84334055be15cc3014555be41de6ad683097fb7c8eeb7db5f645857f0ed7b4_2022-01-11__151729.exe.dll",DllRegisterServer
    3⤵
    PID:2504

memory/3160-117-0x0000000004393000-0x0000000004394000-memory.dmp

Download

memory/3160-116-0x0000000004371000-0x0000000004393000-memory.dmp

Download