emotet | bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab

Analysis

Target
emotet_exe_e5_bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab_2022-01-17__222717.exe.dll
Size 469KB
Sample220117-2dpmxsdcd9
SHA256 bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab
MD5 e57de794f4c7bc0a384a7297f21f645f
SHA1 55d2928298371eb9df796e6bb4a3a63a45c5a149
SHA512 d091b976b5e0e3a831d1d907b3a6e47e3e7e669fc28ff28a27794c33d1f050b2d586112783746740833574cc52b132a72a6e9e92c7849b4d599e35c082526449
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28
PID 1528 wrote to memory of 516	1528	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab_2022-01-17__222717.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab_2022-01-17__222717.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcf8ef13e7ec935f9082d576f142ce1f93aa2063fba6d5986a3039097d0742ab_2022-01-17__222717.exe.dll",DllRegisterServer
    3⤵
    PID:516

memory/1520-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download

memory/1528-57-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/1528-59-0x00000000002C3000-0x00000000002C4000-memory.dmp

Download

memory/1528-58-0x00000000002A1000-0x00000000002C3000-memory.dmp

Download