emotet | 16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29

Analysis

Target
emotet_exe_e4_16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29_2022-01-25__000523.dll
Size 780KB
Sample220125-ads7kachbm
SHA256 16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29
MD5 94665b49ba2d34c1dcc57271555cfbda
SHA1 fc6695af9c090cac7d3f6e1169440ab44c1d06b9
SHA512 7d429cdc46bfe98d5656f1530294592d81784c509f7024be317c12b2c991d8037a3f287b97cb7b02bd5665660adc9bdd0c08e27cadc8cec7b8d657c5aa804c69
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2696	2632	regsvr32.exe	68
PID 2632 wrote to memory of 2696	2632	regsvr32.exe	68
PID 2632 wrote to memory of 2696	2632	regsvr32.exe	68
PID 2696 wrote to memory of 1580	2696	regsvr32.exe	69
PID 2696 wrote to memory of 1580	2696	regsvr32.exe	69
PID 2696 wrote to memory of 1580	2696	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29_2022-01-25__000523.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29_2022-01-25__000523.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_16d6e433f7893e14a1d4897c2b8258f6a8f8d254b0d34fecf8ade4276fe1fd29_2022-01-25__000523.dll",DllRegisterServer
    3⤵
    PID:1580

memory/2696-118-0x0000000002F90000-0x0000000002FB5000-memory.dmp

Download