emotet | 0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79

Analysis

Target
emotet_exe_e5_0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79_2022-01-25__000544.dll
Size 676KB
Sample220125-advemacgb2
SHA256 0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79
MD5 51b0b7ea426f9160f8725f4de0b59b08
SHA1 f1c4610f173ec0a3552c9c7d16c03f0e1ba91ce0
SHA512 fabb8367b60ba5cbc6f03b90424faa17ee75bf07aded78b0912d41d35aa3e5c805b421359e488d0362d52c7ed06b9611e0f2e4322a6662f1c4d526af17e14b94
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2820	2796	regsvr32.exe	69
PID 2796 wrote to memory of 2820	2796	regsvr32.exe	69
PID 2796 wrote to memory of 2820	2796	regsvr32.exe	69
PID 2820 wrote to memory of 2332	2820	regsvr32.exe	70
PID 2820 wrote to memory of 2332	2820	regsvr32.exe	70
PID 2820 wrote to memory of 2332	2820	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79_2022-01-25__000544.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79_2022-01-25__000544.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0381e6134e5d3a8fe55baed788dc6baf7cd277d756aaf0afe83aeb236e2c6c79_2022-01-25__000544.dll",DllRegisterServer
    3⤵
    PID:2332

memory/2820-118-0x0000000004540000-0x0000000004568000-memory.dmp

Download