emotet | c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f

Analysis

Target
emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
Size 408KB
Sample220119-pp2qeahgak
SHA256 c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f
MD5 059f35b70f85c44f367145a209035b9a
SHA1 96dd487486f77039d8b5a2f9b074d68fbd2f15ce
SHA512 773b3bd7c238b1cad48048f43e0ad5cc54e4d247d0d5aca6ef447c74382471f2aebd93fb7604d57268104da23c79f8d9f2c78e93fbe197b3f115fda944bffa5d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1668 wrote to memory of 1468	1668	regsvr32.exe	27
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28
PID 1468 wrote to memory of 1612	1468	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll",DllRegisterServer
    3⤵
    PID:1612

memory/1468-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1468-57-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1668-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download