emotet | f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361

Analysis

Target
emotet_exe_e4_f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361_2022-01-24__163648.dll
Size 664KB
Sample220124-t4vymaffa9
SHA256 f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361
MD5 bf5c3e5f150da202f64056c743a2164a
SHA1 8f226daee7826e6c115042e0129c00b2d656d561
SHA512 5251313b4cbcad2168ad5403d990091de50fff8b7a56a97fa2fe35a2837f9ee5ef4305767daef1299c04b2a37170fb99e5c32ef777eb0b908870ee54df73b604
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1096 wrote to memory of 1664	1096	regsvr32.exe	27
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28
PID 1664 wrote to memory of 584	1664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361_2022-01-24__163648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361_2022-01-24__163648.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f7de35c23effb30df2e672aa564385d7f3489ee48637ec09eb0328ce67511361_2022-01-24__163648.dll",DllRegisterServer
    3⤵
    PID:584

memory/1096-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Download

memory/1664-55-0x0000000076491000-0x0000000076493000-memory.dmp

Download

memory/1664-56-0x00000000005E0000-0x0000000000606000-memory.dmp

Download