emotet | 0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7

Analysis

Target
emotet_exe_e4_0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7_2022-01-23__000403.dll
Size 615KB
Sample220123-ac7zbsdgc4
SHA256 0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7
MD5 71e90b405688847ac5e1bcb49a1a857b
SHA1 ca45ae3c4b67b0fa3a653ed999408682380e8155
SHA512 17f24194867f3408e809a38d03d9dad5fd4c1226a273baad8b93b5641eb20f049f4e7ed356e87e192b94fba7c8f0702ee1993156dc4d10ada63fb9a13e813f43
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1972	3504	regsvr32.exe	68
PID 3504 wrote to memory of 1972	3504	regsvr32.exe	68
PID 3504 wrote to memory of 1972	3504	regsvr32.exe	68
PID 1972 wrote to memory of 2140	1972	regsvr32.exe	69
PID 1972 wrote to memory of 2140	1972	regsvr32.exe	69
PID 1972 wrote to memory of 2140	1972	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7_2022-01-23__000403.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7_2022-01-23__000403.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0562095e7359ce47982d1c4a22abe636ec04d2b8114d551818c057ef36392ed7_2022-01-23__000403.dll",DllRegisterServer
    3⤵
    PID:2140

memory/1972-119-0x0000000004DD0000-0x0000000004DF6000-memory.dmp

Download