emotet | ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f

Analysis

Target
emotet_exe_e4_ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f_2022-01-25__000522.dll
Size 780KB
Sample220125-adthbscga3
SHA256 ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f
MD5 b11f637b77d7c789089dbe3b5ea42806
SHA1 5396ae2313922c0920cee56ea88aafcf0ff3af83
SHA512 bac8d89916f62a87292f8e9cb9e80905df30ed948654f896a67269c1c524fcc01f44b10cbddf833a7ac0081fcd7290cda5593c81f728124bca053bb8e8fe22f8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4056	2764	regsvr32.exe	68
PID 2764 wrote to memory of 4056	2764	regsvr32.exe	68
PID 2764 wrote to memory of 4056	2764	regsvr32.exe	68
PID 4056 wrote to memory of 1844	4056	regsvr32.exe	69
PID 4056 wrote to memory of 1844	4056	regsvr32.exe	69
PID 4056 wrote to memory of 1844	4056	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f_2022-01-25__000522.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f_2022-01-25__000522.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ce77a9419fdd5d8b1aa9b43081d3f08e93266d9dfc0249d7378cb44677532f0f_2022-01-25__000522.dll",DllRegisterServer
    3⤵
    PID:1844

memory/4056-118-0x0000000004B90000-0x0000000004BB5000-memory.dmp

Download