emotet | 379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99

Analysis

Target
emotet_exe_e4_379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99_2022-01-25__000523.dll
Size 780KB
Sample220125-adthbscga4
SHA256 379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99
MD5 24903976436fd9a1a3f0c9c5521bc9df
SHA1 f268551b9ed6d931536fd3e39ff0e8be2db88b96
SHA512 d859f19c8093836c8909389154e082c3f2185a86bd9a3700f4d83f4f83ff22c75cbf2fe600bbd56f84a185ca544a388f636bbd48fec270c9dc4da7b849e8967a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3908	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3908	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3908	3068	regsvr32.exe	69
PID 3908 wrote to memory of 3424	3908	regsvr32.exe	70
PID 3908 wrote to memory of 3424	3908	regsvr32.exe	70
PID 3908 wrote to memory of 3424	3908	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99_2022-01-25__000523.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99_2022-01-25__000523.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_379f833e84c024ac4e5f4f87c72039d13768db12b170f8fe5c5ff4f8b9923e99_2022-01-25__000523.dll",DllRegisterServer
    3⤵
    PID:3424

memory/3908-115-0x0000000004E50000-0x0000000004E75000-memory.dmp

Download