emotet | 39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea

Analysis

Target
emotet_exe_e5_39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea_2022-01-22__000008.dll
Size 620KB
Sample220122-aawtaaedcj
SHA256 39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea
MD5 18dcdd4e556a6994985dce7b65a6c442
SHA1 4742af40b2992bc7891f94420c4a75252fd6db4a
SHA512 7a52d8eaf4d2f537ec1595efeb3a6f9d96d684b8e2608c350b7cd448b6d47e0f201330068c47bc060bcff05338f49fae63da1e7dc8df4ae55b89e2425be48487
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3056	1804	regsvr32.exe	69
PID 1804 wrote to memory of 3056	1804	regsvr32.exe	69
PID 1804 wrote to memory of 3056	1804	regsvr32.exe	69
PID 3056 wrote to memory of 3244	3056	regsvr32.exe	70
PID 3056 wrote to memory of 3244	3056	regsvr32.exe	70
PID 3056 wrote to memory of 3244	3056	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea_2022-01-22__000008.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea_2022-01-22__000008.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39a746fb6b243fbdeb879d1a1d6baa66ba66f144a9a2f78541bd99f0baec7eea_2022-01-22__000008.dll",DllRegisterServer
    3⤵
    PID:3244

memory/3056-119-0x0000000001070000-0x0000000001098000-memory.dmp

Download