emotet | ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f

Analysis

Target
emotet_exe_e5_ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f_2022-01-25__000543.dll
Size 676KB
Sample220125-adv16acgb5
SHA256 ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f
MD5 77745c15fb8b1f320dcb6aac9f8ecd85
SHA1 47e3f35634f127a15842bbb6f916d307263857b7
SHA512 8ac5e31138d9abf6a853665ff51f056fcb6af4d7e35b092b5621fce445e990babc468ce4d037ffbbb64464631195775db9f0c3f1e347677080fa469d04185d5c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2508	2356	regsvr32.exe	68
PID 2356 wrote to memory of 2508	2356	regsvr32.exe	68
PID 2356 wrote to memory of 2508	2356	regsvr32.exe	68
PID 2508 wrote to memory of 3068	2508	regsvr32.exe	69
PID 2508 wrote to memory of 3068	2508	regsvr32.exe	69
PID 2508 wrote to memory of 3068	2508	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f_2022-01-25__000543.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f_2022-01-25__000543.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ce99231de1c048a237f8030cc7cb0a61555a201d793d219d38c756dcb806722f_2022-01-25__000543.dll",DllRegisterServer
    3⤵
    PID:3068

memory/2508-119-0x0000000001310000-0x0000000001338000-memory.dmp

Download