emotet | ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a

Analysis

Target
emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
Size 602KB
Sample220119-sefxqsahcm
SHA256 ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a
MD5 2de682ad58c3525fd332ee64f120e643
SHA1 4f89512104da767d66a450b98f54da949b12be39
SHA512 7b31c7823f3fa7b7b51e58c44b60241a2238532c2901b543f1cafbc147c14d9877ed554049c10a50b0a561d5b8e71f6985c8d9263b54db1a216d25cfc49d30f3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 1584	3660	regsvr32.exe	51
PID 3660 wrote to memory of 1584	3660	regsvr32.exe	51
PID 3660 wrote to memory of 1584	3660	regsvr32.exe	51
PID 1584 wrote to memory of 3292	1584	regsvr32.exe	52
PID 1584 wrote to memory of 3292	1584	regsvr32.exe	52
PID 1584 wrote to memory of 3292	1584	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll",DllRegisterServer
    3⤵
    PID:3292

memory/1584-130-0x0000000004520000-0x0000000004548000-memory.dmp

Download