emotet | 6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84

Analysis

Target
emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
Size 716KB
Sample220124-llgz2sebbl
SHA256 6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84
MD5 fb0ae287bea43ee292de6e8ab5e51f1d
SHA1 f83fa18cb0ee76767471488b77d3fbf5651a9b7f
SHA512 0bde059a08276594509a31929231a7d9dd049580107c378384eabd77984504c6bad7b2bd180a686be7b55877dd41252baebfd2ac68515160eb03720f99fd09ce
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1932	1388	regsvr32.exe	27
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28
PID 1932 wrote to memory of 1148	1932	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll",DllRegisterServer
    3⤵
    PID:1148

memory/1388-54-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Download

memory/1932-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Download

memory/1932-57-0x0000000000180000-0x00000000001A6000-memory.dmp

Download