emotet | a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c

Analysis

Target
emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
Size 664KB
Sample220124-t4vymaffb2
SHA256 a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c
MD5 4f9303f002f0abda3bceba1ca2f353ce
SHA1 212fe98bc2307052b7f769a6e487d4eb90415a2b
SHA512 ca74e569b1d86ca8f55c70870cb13c9ad509ac96a8ebe24573ce420b70ee5e269fe6bb035a72b8022aefc3ed4a80679e46dee259be5e0018b86ce592a1882127
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll",DllRegisterServer
    3⤵
    PID:1248

memory/1288-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1288-56-0x00000000001B0000-0x00000000001D6000-memory.dmp

Download

memory/1468-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download