emotet | 5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e

Analysis

Target
emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
Size 420KB
Sample220119-ql9saaabc8
SHA256 5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e
MD5 35961c1767739e75d864a6ab789e4ddb
SHA1 5d1f78008f287caf55f8db183be4a74bb8c11803
SHA512 7be7ae17fafdefa063eb107534443208d4dab773197e9d978edee0f71e983d294b58d407ca5722b14604eba31de7c79e0fc2767b3c0a77d42ab6d2c76477795c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1888	1720	regsvr32.exe	27
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28
PID 1888 wrote to memory of 1116	1888	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5be2a597f4dd189e582baa743546c71385c1ca8be2e0bf56755c0e08d8deec3e_2022-01-19__132150.exe.dll",DllRegisterServer
    3⤵
    PID:1116

memory/1720-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1888-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1888-56-0x0000000000910000-0x0000000000938000-memory.dmp

Download