emotet | 0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc

Analysis

Target
emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
Size 676KB
Sample220125-advemacga9
SHA256 0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc
MD5 0ce145d4984c2c96553092e5f1688a24
SHA1 6a86453754fc365c53abb93c4313c99b49303e00
SHA512 cb71ad938932ccc3222271e89b0939ac45b6bf33b781c7a3507ebdb025c54edd30df2ed595405bcf2e15cbb7177c2e69bf93600dd2782e35a26966b45a550349
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1524	1684	regsvr32.exe	27
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28
PID 1524 wrote to memory of 868	1524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll",DllRegisterServer
    3⤵
    PID:868

memory/1524-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1524-57-0x00000000001B0000-0x00000000001D8000-memory.dmp

Download

memory/1684-54-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download