emotet | d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f

Analysis

Target
emotet_exe_e5_d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f_2022-01-25__075123.dll
Size 642KB
Sample220125-jqepdabecj
SHA256 d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f
MD5 131d7cc30378348679fb3dd137aae8eb
SHA1 8f6718e94ecdce1d41fe35938a55f7799dbdba6e
SHA512 63b0706e5a87c17fdf894f82b8ddd4a1a92eacdea94b26bcb9b7e9e4410ae976abcbe5f4f467821d321624b15ffcb86d0d26b5bb50953d1d02e23da948f04251
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3152	3540	regsvr32.exe	69
PID 3540 wrote to memory of 3152	3540	regsvr32.exe	69
PID 3540 wrote to memory of 3152	3540	regsvr32.exe	69
PID 3152 wrote to memory of 3124	3152	regsvr32.exe	70
PID 3152 wrote to memory of 3124	3152	regsvr32.exe	70
PID 3152 wrote to memory of 3124	3152	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f_2022-01-25__075123.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f_2022-01-25__075123.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d1c306eb9fa784348976a14db86034da1eb3dcc1eaf89d50a2416a4e5169718f_2022-01-25__075123.dll",DllRegisterServer
    3⤵
    PID:3124

memory/3152-118-0x0000000002D10000-0x0000000002D38000-memory.dmp

Download