emotet | 41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca

Analysis

Target
emotet_exe_e5_41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca_2022-01-25__000543.dll
Size 676KB
Sample220125-adv16acgb6
SHA256 41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca
MD5 e2e40808f28113d905c2a33d5136c87c
SHA1 00a8adde250fffe28ee6a36072b88af1f4114674
SHA512 3b8efbe12021df395a00d38d202538cafb7bf278a6a826e8d532a8e842cddfcb5e7aef5c1200d6a1e98c4092e5505aa8ae7455ea16b7ff40d8d64ad82c28670b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3468	3708	regsvr32.exe	68
PID 3708 wrote to memory of 3468	3708	regsvr32.exe	68
PID 3708 wrote to memory of 3468	3708	regsvr32.exe	68
PID 3468 wrote to memory of 3568	3468	regsvr32.exe	69
PID 3468 wrote to memory of 3568	3468	regsvr32.exe	69
PID 3468 wrote to memory of 3568	3468	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca_2022-01-25__000543.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca_2022-01-25__000543.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_41fd275d87bdb6419e1cbc622b60f1f4de9e7a06bc7b17711efae03aa4f8f5ca_2022-01-25__000543.dll",DllRegisterServer
    3⤵
    PID:3568

memory/3468-115-0x0000000004D80000-0x0000000004DA8000-memory.dmp

Download