emotet | 835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a

Analysis

Target
emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
Size 615KB
Sample220122-ppj6csahh2
SHA256 835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a
MD5 322573735a5314a8132eb205a96de32e
SHA1 67ffca898eb7444151d6240f8a6e50310bea19b0
SHA512 d325bbe91608c945d5bfe9537308005df6489e5a2bf35741e7c647c94d8bc36eef0efd6dacb0ed850e9ae46b998149aa779714db0a0e2322cec393ad683a26e0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2744	2704	regsvr32.exe	68
PID 2704 wrote to memory of 2744	2704	regsvr32.exe	68
PID 2704 wrote to memory of 2744	2704	regsvr32.exe	68
PID 2744 wrote to memory of 3780	2744	regsvr32.exe	69
PID 2744 wrote to memory of 3780	2744	regsvr32.exe	69
PID 2744 wrote to memory of 3780	2744	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll",DllRegisterServer
    3⤵
    PID:3780

memory/2744-118-0x0000000002810000-0x0000000002836000-memory.dmp

Download