emotet | 8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2

Analysis

Target
emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
Size 408KB
Sample220119-pp2qeahfhq
SHA256 8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2
MD5 d389ecd2e845cec4658a843fc6fb7cec
SHA1 bb805ea17a1de9ece19d341ebe66978e2cd9e1d9
SHA512 1da6a019da83bb211c8576fe0532f708b564c6a22d79b55832e58fa76b16826631d406f058f497817ff11bf1d456233a0a51f555becbb772480e6fa4c619b964
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1512 wrote to memory of 1696	1512	regsvr32.exe	27
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1228	1696	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8f491e695ad6d9696c02650ca1ac25448d5123897682b2cfa3c9fae7c6075cf2_2022-01-19__123037.exe.dll",DllRegisterServer
    3⤵
    PID:1228

memory/1512-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download

memory/1696-55-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1696-56-0x00000000001B0000-0x00000000001D6000-memory.dmp

Download