emotet | fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915

Analysis

Target
emotet_exe_e5_fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915_2022-01-19__000911.exe.dll
Size 408KB
Sample220119-af59xaebd4
SHA256 fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915
MD5 9ceeb5c2c0a4efccf7f6d9e679e5e423
SHA1 d0483bafada843842a3e99d0df7940aaffe2d61b
SHA512 a118b8b924adcf843fc2a817a367cdb63f369f84146a9b5a9f566153d0d62275f766130842bd827957d4b618a2826378028a7cef689b4baa60cbdddd0513c5f0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2968	3848	regsvr32.exe	51
PID 3848 wrote to memory of 2968	3848	regsvr32.exe	51
PID 3848 wrote to memory of 2968	3848	regsvr32.exe	51
PID 2968 wrote to memory of 3984	2968	regsvr32.exe	54
PID 2968 wrote to memory of 3984	2968	regsvr32.exe	54
PID 2968 wrote to memory of 3984	2968	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915_2022-01-19__000911.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915_2022-01-19__000911.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fde5c4a36fa4f0c825e2022b2c3d9f3155f76913373294c1fea7ee57d38ea915_2022-01-19__000911.exe.dll",DllRegisterServer
    3⤵
    PID:3984

memory/2968-130-0x0000000004850000-0x0000000004878000-memory.dmp

Download