emotet | 2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f

Analysis

Target
emotet_exe_e5_2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f_2022-01-18__202828.exe.dll
Size 408KB
Sample220118-y9j6jadbdr
SHA256 2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f
MD5 85153957055f63983359ecdb3eccd511
SHA1 e3cd19a5a5c1fc3025d90d11f9d79e741261f6d6
SHA512 b845c7ec4d63ac5cfbbea877926037d06ccb2cb3ec8ffe77017f49d0e8f250407da1c4c0e8173aa1b8849d1bd6d8f9a05b06fd4046523023061bf00440a23b21
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 552	3800	regsvr32.exe	51
PID 3800 wrote to memory of 552	3800	regsvr32.exe	51
PID 3800 wrote to memory of 552	3800	regsvr32.exe	51
PID 552 wrote to memory of 2428	552	regsvr32.exe	53
PID 552 wrote to memory of 2428	552	regsvr32.exe	53
PID 552 wrote to memory of 2428	552	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f_2022-01-18__202828.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f_2022-01-18__202828.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2949a3d8bc89fb436b02ee417dd1230d9f3dc4fa1cc6364a6b900b61332e906f_2022-01-18__202828.exe.dll",DllRegisterServer
    3⤵
    PID:2428

memory/552-133-0x0000000004270000-0x0000000004298000-memory.dmp

Download