emotet | 0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b

Analysis

Target
emotet_exe_e4_0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b_2022-01-24__175227.dll
Size 780KB
Sample220124-wga12sgdfj
SHA256 0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b
MD5 a287c2b33796826dad6f0f23880215ae
SHA1 a33031d6c797b6fa24f22e280fab836862cbd92c
SHA512 310bb68935ff9def5da95659bf0209f2dea3d29f125b6d2fe1e57c316c5f24366a18e1ccaff72f56016d0e892b650c30b08484fc9dfba11014e155a6c7916bb5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3264	2692	regsvr32.exe	68
PID 2692 wrote to memory of 3264	2692	regsvr32.exe	68
PID 2692 wrote to memory of 3264	2692	regsvr32.exe	68
PID 3264 wrote to memory of 996	3264	regsvr32.exe	69
PID 3264 wrote to memory of 996	3264	regsvr32.exe	69
PID 3264 wrote to memory of 996	3264	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b_2022-01-24__175227.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b_2022-01-24__175227.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0fef3250167a91dcc53aad262b8f95f7a9819f2ade891f3da9e8601ccd86265b_2022-01-24__175227.dll",DllRegisterServer
    3⤵
    PID:996

memory/3264-118-0x0000000004F00000-0x0000000004F25000-memory.dmp

Download