emotet | 3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9

Analysis

Target
emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
Size 735KB
Sample220112-adrnqsaddk
SHA256 3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9
MD5 facccb00e4c8b77343db01b9cdbbf7bd
SHA1 84cbdd7920241c7d76e4661c62e31fec761d770a
SHA512 c76d2de3342940b50f679017393fbdd392a31f1756eaaee6f44d41c8ff9329254f93c8634fc02a274c4c007ba0ca860cae0587310624dad55a031cda8f6291a7
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 368	3772	regsvr32.exe	69
PID 3772 wrote to memory of 368	3772	regsvr32.exe	69
PID 3772 wrote to memory of 368	3772	regsvr32.exe	69
PID 368 wrote to memory of 3800	368	regsvr32.exe	70
PID 368 wrote to memory of 3800	368	regsvr32.exe	70
PID 368 wrote to memory of 3800	368	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3c0d36a47b2ab92f79dced6285dc0d3b47d1f01b93f80fc3b7744162bfc457d9_2022-01-12__000547.exe.dll",DllRegisterServer
    3⤵
    PID:3800

memory/368-117-0x0000000004EA3000-0x0000000004EA4000-memory.dmp

Download

memory/368-116-0x0000000004E81000-0x0000000004EA3000-memory.dmp

Download