emotet | 27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760

Analysis

Target
emotet_exe_e4_27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760_2022-01-24__163646.dll
Size 664KB
Sample220124-t4tessffa7
SHA256 27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760
MD5 42074126cf39d3fac94b043c7fb66b2f
SHA1 5d88b74ad5fd9ab8c72f59b40592691c1f8e60d8
SHA512 4177b33e1ff6056e140e75af78bbd7c3b4e52def04b346d6fc15ea6f2a6064718dbc124c7df9e937c873b91f020dc214d161cc97b3daec7e96d979f6ce80c183
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 656	1348	regsvr32.exe	69
PID 1348 wrote to memory of 656	1348	regsvr32.exe	69
PID 1348 wrote to memory of 656	1348	regsvr32.exe	69
PID 656 wrote to memory of 2216	656	regsvr32.exe	70
PID 656 wrote to memory of 2216	656	regsvr32.exe	70
PID 656 wrote to memory of 2216	656	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760_2022-01-24__163646.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760_2022-01-24__163646.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_27e902cbf28d205ff4b5bc1eed5d504fe214935e6771203147315fb6cccb0760_2022-01-24__163646.dll",DllRegisterServer
    3⤵
    PID:2216

memory/656-119-0x0000000004130000-0x0000000004156000-memory.dmp

Download