emotet | 87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb

Analysis

Target
emotet_exe_e5_87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb_2022-01-25__000544.dll
Size 676KB
Sample220125-adwbxschcq
SHA256 87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb
MD5 bae0507d06dbec2ba63aa32b70e43b73
SHA1 e7866c9a41d3c5ec384285628c380448fb674345
SHA512 e3d1fee48e023474f0b00e22c27ef3ced5cedbdc4e80bb9a33d4dbfd3653879eb2141243749812ee177cb2a82afc5883c8d5f54df7f481b953bf24d44a7faabd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2740	2472	regsvr32.exe	68
PID 2472 wrote to memory of 2740	2472	regsvr32.exe	68
PID 2472 wrote to memory of 2740	2472	regsvr32.exe	68
PID 2740 wrote to memory of 2812	2740	regsvr32.exe	69
PID 2740 wrote to memory of 2812	2740	regsvr32.exe	69
PID 2740 wrote to memory of 2812	2740	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb_2022-01-25__000544.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb_2022-01-25__000544.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_87b334b2784d59af0efc25802ba458499af8aa0df9e2b20b0c33832e4a52bdbb_2022-01-25__000544.dll",DllRegisterServer
    3⤵
    PID:2812

memory/2740-116-0x00000000043B0000-0x00000000043D8000-memory.dmp

Download