emotet | d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3

Analysis

Target
emotet_exe_e5_d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3_2022-01-19__150108.exe.dll
Size 602KB
Sample220119-sefxqsahe9
SHA256 d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3
MD5 0dacfde969d069f10909506848f0e7f4
SHA1 ed38917e03c5c522c4252a632de7a3dff7895aa0
SHA512 ec1544639725e8949e6a70f177847af319723f54333d79cd165e844ac07bd1f8682ba36f957776873fe8fc5106e63a96dc8494d9a5432a52a56474d1f0b6358b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2616	1304	regsvr32.exe	52
PID 1304 wrote to memory of 2616	1304	regsvr32.exe	52
PID 1304 wrote to memory of 2616	1304	regsvr32.exe	52
PID 2616 wrote to memory of 512	2616	regsvr32.exe	53
PID 2616 wrote to memory of 512	2616	regsvr32.exe	53
PID 2616 wrote to memory of 512	2616	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3_2022-01-19__150108.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3_2022-01-19__150108.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d313478dcc06ada681f8e6fec4e29dad4b3523d5d7b2a2d38f47ea5f5fabf9c3_2022-01-19__150108.exe.dll",DllRegisterServer
    3⤵
    PID:512

memory/2616-130-0x00000000027E0000-0x0000000002808000-memory.dmp

Download