emotet | f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8

Analysis

Target
emotet_exe_e4_f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8_2022-01-19__000645.exe.dll
Size 398KB
Sample220119-aey47seber
SHA256 f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8
MD5 627468bdcbb881ed847b7b714f52cc5c
SHA1 3fb7c49f333a744985eb81184d8dda7d8b3be3f3
SHA512 f8cf33494907cd8d7d397b3659bb3ae07e05e6ff05cb673d30eaadaeecdb2b37c73ce43a3ed89df9d0cd545ccb0e7f1e7af3e816f7c64787c21a7b3c6e74b974
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 540	1396	regsvr32.exe	53
PID 1396 wrote to memory of 540	1396	regsvr32.exe	53
PID 1396 wrote to memory of 540	1396	regsvr32.exe	53
PID 540 wrote to memory of 916	540	regsvr32.exe	54
PID 540 wrote to memory of 916	540	regsvr32.exe	54
PID 540 wrote to memory of 916	540	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8_2022-01-19__000645.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8_2022-01-19__000645.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f40ba5daf913be48e8d74dbe8fc51f77652d66c2366145d4b87ba86b04f5d0d8_2022-01-19__000645.exe.dll",DllRegisterServer
    3⤵
    PID:916

memory/540-133-0x0000000002A70000-0x0000000002A96000-memory.dmp

Download