emotet | 50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e

Analysis

Target
emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
Size 469KB
Sample220118-aexalsefem
SHA256 50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e
MD5 a8b595feb326ed5e1db5e314eb56ebba
SHA1 0b5e3d1972ad122ce6a0bd99f18cafc5a948471b
SHA512 865c58926f8fb7f27fd04b413674c7c8bd2205279e7021852bc5efa053d6a7480dfe26fbbff18d97f9476626f9a651601c6cd388cad04cb81d6f863c83a1e344
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 744 wrote to memory of 1580	744	regsvr32.exe	27
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28
PID 1580 wrote to memory of 760	1580	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_50437a0fcfb45356ced8ec185421bfbcb62ec3dd26826d348f11099b64da044e_2022-01-18__000719.exe.dll",DllRegisterServer
    3⤵
    PID:760

memory/744-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1580-57-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1580-59-0x0000000000643000-0x0000000000644000-memory.dmp

Download

memory/1580-58-0x0000000000621000-0x0000000000643000-memory.dmp

Download