emotet | e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0

Analysis

Target
emotet_exe_e5_e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0_2022-01-25__000543.dll
Size 676KB
Sample220125-advqdscgb3
SHA256 e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0
MD5 57f073183c56852d0da8d317933af6f3
SHA1 11966f53a494628930421722726a4688924c303c
SHA512 4341aa77dc993111db36953ea0fb663f3f8326de97e6d510395e75cb9eb211e89fed8a6d0e6e46438f7c1a38be64bb982e124b5b45d48794c2bc1829cc9feb10
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4084	3988	regsvr32.exe	69
PID 3988 wrote to memory of 4084	3988	regsvr32.exe	69
PID 3988 wrote to memory of 4084	3988	regsvr32.exe	69
PID 4084 wrote to memory of 1180	4084	regsvr32.exe	70
PID 4084 wrote to memory of 1180	4084	regsvr32.exe	70
PID 4084 wrote to memory of 1180	4084	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0_2022-01-25__000543.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0_2022-01-25__000543.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e00bfa33c7359f357b489f9f1a7fb28d1a01384396fc557b0e42b397f44642b0_2022-01-25__000543.dll",DllRegisterServer
    3⤵
    PID:1180

memory/4084-115-0x0000000000A20000-0x0000000000A48000-memory.dmp

Download