emotet | 7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0

Analysis

Target
emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
Size 735KB
Sample220112-adrnqsabe9
SHA256 7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0
MD5 4f3d4bb7e0772397ad4ba16f44528b1a
SHA1 e8960a1b30cc2e684f5cd10ac3707be14f49ad67
SHA512 db004a25910c2b43e77ef0c9fc0e85030fe32dae1fb3c804f0da3dbe6392dc25f7585a0033c17b4283a686a4ad6307a252db16b5c3de5d9b9eac85cede549d16
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2728	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2728	2680	regsvr32.exe	68
PID 2680 wrote to memory of 2728	2680	regsvr32.exe	68
PID 2728 wrote to memory of 1360	2728	regsvr32.exe	69
PID 2728 wrote to memory of 1360	2728	regsvr32.exe	69
PID 2728 wrote to memory of 1360	2728	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7dcbc088af5723e2ffe5d63788894b10644bc340d5a587562b2fa5c3bd729eb0_2022-01-12__000549.exe.dll",DllRegisterServer
    3⤵
    PID:1360

memory/2728-117-0x0000000001373000-0x0000000001374000-memory.dmp

Download

memory/2728-116-0x0000000001351000-0x0000000001373000-memory.dmp

Download