emotet | f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75

Analysis

Target
emotet_exe_e5_f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75_2022-01-25__000543.dll
Size 676KB
Sample220125-advemachcj
SHA256 f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75
MD5 a74314d5d8aebe6e03f4bd8603939d74
SHA1 f8d7a044e0d33ce63fb48d6edeeee2588ff4d283
SHA512 e602ae3e5df3f6fa07f4266c7c2fb118d1a16318b7a35ce2421b0ad2d6394f4e53da8a746e0ff364efd41d4198d03bcb9b91ba7c5f80933ddeb911b7f98023f8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2160	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2160	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2160	2700	regsvr32.exe	68
PID 2160 wrote to memory of 3712	2160	regsvr32.exe	69
PID 2160 wrote to memory of 3712	2160	regsvr32.exe	69
PID 2160 wrote to memory of 3712	2160	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75_2022-01-25__000543.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75_2022-01-25__000543.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33fdcd30adf30d24c93fbd4967aed7c6b0ad6bf6b6e5f0d01e290ddd8a5db75_2022-01-25__000543.dll",DllRegisterServer
    3⤵
    PID:3712

memory/2160-115-0x0000000004BC0000-0x0000000004BE8000-memory.dmp

Download