emotet | 7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0

Analysis

Target
emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
Size 735KB
Sample220112-adrnqsabe9
SHA256 7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0
MD5 4f3d4bb7e0772397ad4ba16f44528b1a
SHA1 e8960a1b30cc2e684f5cd10ac3707be14f49ad67
SHA512 db004a25910c2b43e77ef0c9fc0e85030fe32dae1fb3c804f0da3dbe6392dc25f7585a0033c17b4283a686a4ad6307a252db16b5c3de5d9b9eac85cede549d16
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1592 wrote to memory of 1636	1592	regsvr32.exe	27
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1632	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll",DllRegisterServer
    3⤵
    PID:1632

memory/1592-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download

memory/1636-56-0x0000000076421000-0x0000000076423000-memory.dmp

Download

memory/1636-58-0x0000000000323000-0x0000000000324000-memory.dmp

Download

memory/1636-57-0x0000000000301000-0x0000000000323000-memory.dmp

Download