emotet | 4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e

Analysis

Target
emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
Size 398KB
Sample220119-aey47sebc5
SHA256 4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e
MD5 71d7766fe884d312f8e55de4df4b6020
SHA1 52cdb81f7a4f532bacc742b0587e8f1c3432457d
SHA512 6d1926163111f9e27c81c819af938aba0561d46a892481f0ff0b559cd0301a8f3e979ae476163088879b62957615eabb4ec6bdcab004ba780302c8282fef9c8b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 1860 wrote to memory of 268	1860	regsvr32.exe	27
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28
PID 268 wrote to memory of 756	268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll",DllRegisterServer
    3⤵
    PID:756

memory/268-55-0x0000000075891000-0x0000000075893000-memory.dmp

Download

memory/268-56-0x0000000000630000-0x0000000000656000-memory.dmp

Download

memory/1860-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Download