emotet | 831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b

Analysis

Target
emotet_exe_e5_831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b_2022-01-17__222716.exe.dll
Size 469KB
Sample220117-2dpmxsdgcq
SHA256 831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b
MD5 6b2c9a8568bdb759ec88b3c34b75782e
SHA1 8f603f639531fa2064327e41cb240753fd559954
SHA512 98b57f500aee106298c3c433c217285a764532c93cf4e7eb2ef1570ac0521fc5c444187f5d1aa44423950fb183967a265108bae794d27e64343ebd1c0020d4ee
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28
PID 516 wrote to memory of 696	516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b_2022-01-17__222716.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b_2022-01-17__222716.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_831ce96ef468d175f597667dfce2ec3ad0ab77ef1828d623c9f1c3b1213f472b_2022-01-17__222716.exe.dll",DllRegisterServer
    3⤵
    PID:696

memory/516-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/516-58-0x00000000003E3000-0x00000000003E4000-memory.dmp

Download

memory/516-57-0x00000000003C1000-0x00000000003E3000-memory.dmp

Download

memory/956-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download