emotet | 3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9

Analysis

Target
emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
Size 735KB
Sample220112-adrnqsaddk
SHA256 3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9
MD5 facccb00e4c8b77343db01b9cdbbf7bd
SHA1 84cbdd7920241c7d76e4661c62e31fec761d770a
SHA512 c76d2de3342940b50f679017393fbdd392a31f1756eaaee6f44d41c8ff9329254f93c8634fc02a274c4c007ba0ca860cae0587310624dad55a031cda8f6291a7
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 316 wrote to memory of 1880	316	regsvr32.exe	27
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28
PID 1880 wrote to memory of 652	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll",DllRegisterServer
    3⤵
    PID:652

memory/316-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

Download

memory/1880-56-0x0000000076001000-0x0000000076003000-memory.dmp

Download

memory/1880-58-0x0000000001DE3000-0x0000000001DE4000-memory.dmp

Download

memory/1880-57-0x0000000001DC1000-0x0000000001DE3000-memory.dmp

Download