emotet | 2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f

Analysis

Target
emotet_exe_e4_2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f_2022-01-24__163645.dll
Size 664KB
Sample220124-t4s42affa6
SHA256 2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f
MD5 2e1507b7ec71ee5d5bd0e4437275f036
SHA1 fbaf53cec8f1249bafa6e247e239bd60a56e3af9
SHA512 9221406d79a2d055bb39dca21028339db7f5f5ee5f432892539b1b54587dba41740045330421a104416c7f8917212c2a39e6af5345e92399c92f1fe384d30079
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3384	2760	regsvr32.exe	68
PID 2760 wrote to memory of 3384	2760	regsvr32.exe	68
PID 2760 wrote to memory of 3384	2760	regsvr32.exe	68
PID 3384 wrote to memory of 2460	3384	regsvr32.exe	69
PID 3384 wrote to memory of 2460	3384	regsvr32.exe	69
PID 3384 wrote to memory of 2460	3384	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f_2022-01-24__163645.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f_2022-01-24__163645.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2e34f36afdb728f273ef862bcfaa4a211375d49881ddac9966061bb5efbc525f_2022-01-24__163645.dll",DllRegisterServer
    3⤵
    PID:2460

memory/3384-118-0x0000000000AD0000-0x0000000000AF6000-memory.dmp

Download