emotet | a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c

Analysis

Target
emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
Size 664KB
Sample220124-t4vymaffb2
SHA256 a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c
MD5 4f9303f002f0abda3bceba1ca2f353ce
SHA1 212fe98bc2307052b7f769a6e487d4eb90415a2b
SHA512 ca74e569b1d86ca8f55c70870cb13c9ad509ac96a8ebe24573ce420b70ee5e269fe6bb035a72b8022aefc3ed4a80679e46dee259be5e0018b86ce592a1882127
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3672	4080	regsvr32.exe	69
PID 4080 wrote to memory of 3672	4080	regsvr32.exe	69
PID 4080 wrote to memory of 3672	4080	regsvr32.exe	69
PID 3672 wrote to memory of 4316	3672	regsvr32.exe	70
PID 3672 wrote to memory of 4316	3672	regsvr32.exe	70
PID 3672 wrote to memory of 4316	3672	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a7020a0aa60f59ef1ac9f99e0fff44294d2dbc2ce98a72dad8104bc2ec216d6c_2022-01-24__163648.dll",DllRegisterServer
    3⤵
    PID:4316

memory/3672-116-0x0000000004780000-0x00000000047A6000-memory.dmp

Download