emotet | 4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940

Analysis

Target
emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
Size 735KB
Sample220112-adrnqsabf2
SHA256 4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940
MD5 5b398f6767692689ce942ceb0eab74ac
SHA1 5cbfc6f9df1ec0e8efd1863f06812493bcd124ca
SHA512 530a69786530e2fd376275f228b909564dd14d0ba68a40983db58fcec9e687f8bab7264c4ae5bdb4446eb2e929078ff880e3a3c596976388450533950dc4d877
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3436	1480	regsvr32.exe	68
PID 1480 wrote to memory of 3436	1480	regsvr32.exe	68
PID 1480 wrote to memory of 3436	1480	regsvr32.exe	68
PID 3436 wrote to memory of 3816	3436	regsvr32.exe	69
PID 3436 wrote to memory of 3816	3436	regsvr32.exe	69
PID 3436 wrote to memory of 3816	3436	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll",DllRegisterServer
    3⤵
    PID:3816

memory/3436-117-0x0000000004783000-0x0000000004784000-memory.dmp

Download

memory/3436-116-0x0000000004761000-0x0000000004783000-memory.dmp

Download