emotet | 7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91

Analysis

Target
emotet_exe_e5_7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91_2022-01-22__000010.dll
Size 620KB
Sample220122-aaw42sdhh8
SHA256 7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91
MD5 80c419a6f9918c6ea222188423e152c2
SHA1 5c75ea261f87807c1acbc002976f37cc6ca0b77c
SHA512 e8daa9e7e67e66ff3d9990defaf882f0593078c9ce68290806ee01bbc784917809cefd2f1cc2d8130211740a9f945bdccfd9ca60f64907af3b718ca9e73354cd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3756	3380	regsvr32.exe	68
PID 3380 wrote to memory of 3756	3380	regsvr32.exe	68
PID 3380 wrote to memory of 3756	3380	regsvr32.exe	68
PID 3756 wrote to memory of 1724	3756	regsvr32.exe	69
PID 3756 wrote to memory of 1724	3756	regsvr32.exe	69
PID 3756 wrote to memory of 1724	3756	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91_2022-01-22__000010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91_2022-01-22__000010.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7cc4eec4a3fbc84103be35f6261d71812f2ca0471750ca1ced5a4945de4a4f91_2022-01-22__000010.dll",DllRegisterServer
    3⤵
    PID:1724

memory/3756-118-0x0000000004540000-0x0000000004568000-memory.dmp

Download