emotet | ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260

Analysis

Target
emotet_exe_e4_ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260_2022-01-22__122938.dll
Size 615KB
Sample220122-ppj6csbbbl
SHA256 ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260
MD5 74eb4078b6ab23ddeea7a338fc037fd6
SHA1 36484c3601e36b682aacb4aea50ed9ad8c3a73df
SHA512 b816a63bf93fa0ad8ef4a1d0257f20c703d22a9e2b45b56ae93a4ae718017cd11476a4fa05d6f46ad685dc57a370c6fc3a7d91593b8e1edf3f273c9b20b07cbb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 732	780	regsvr32.exe	69
PID 780 wrote to memory of 732	780	regsvr32.exe	69
PID 780 wrote to memory of 732	780	regsvr32.exe	69
PID 732 wrote to memory of 1368	732	regsvr32.exe	70
PID 732 wrote to memory of 1368	732	regsvr32.exe	70
PID 732 wrote to memory of 1368	732	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260_2022-01-22__122938.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260_2022-01-22__122938.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba3c4ea133053f4da554d213ecf69ecfe615db8d71d706f279629e9c65d4f260_2022-01-22__122938.dll",DllRegisterServer
    3⤵
    PID:1368

memory/732-118-0x00000000032C0000-0x00000000032E6000-memory.dmp

Download