emotet | 31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a

Analysis

Target
emotet_exe_e5_31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a_2022-01-18__000719.exe.dll
Size 469KB
Sample220118-aexalsefel
SHA256 31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a
MD5 08ae68538e0957a45b8908d4bd5de8cb
SHA1 9ce217fff364f21c93c5ec5a6cd0950fcaccce4c
SHA512 36bde902b70759c7e32af0830178e820a204c9cb6fb7b76aec0cd9daa30c56df64d2c4c2c64c7f052f20741b8377d1385487d471e68dd6228d59e2c7d7234ea2
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 1880 wrote to memory of 608	1880	regsvr32.exe	27
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28
PID 608 wrote to memory of 472	608	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a_2022-01-18__000719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a_2022-01-18__000719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_31aa5f8d3b40d0debbaf2f4956ef13a28d6906481f7ecb3bc4c3acd4f421a23a_2022-01-18__000719.exe.dll",DllRegisterServer
    3⤵
    PID:472

memory/608-56-0x0000000076001000-0x0000000076003000-memory.dmp

Download

memory/608-58-0x0000000000333000-0x0000000000334000-memory.dmp

Download

memory/608-57-0x0000000000311000-0x0000000000333000-memory.dmp

Download

memory/1880-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

Download