emotet | 7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9

Analysis

Target
emotet_exe_e4_7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9_2022-01-25__133446.dll
Size 588KB
Sample220125-qv95eagefl
SHA256 7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9
MD5 a983c679addeff0bcaacab11c39a6eb3
SHA1 4814056c27e8c586c210e76153ecbc85d95e418a
SHA512 4b0924f93ec08a97dcd85ac07e5e8685b668634c16098bdc0a94e386031549e71432a8210835e2d492cb94511452cc2ee05dff7cd2cac63fdb7e02a95b00099c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 392	680	regsvr32.exe	69
PID 680 wrote to memory of 392	680	regsvr32.exe	69
PID 680 wrote to memory of 392	680	regsvr32.exe	69
PID 392 wrote to memory of 1772	392	regsvr32.exe	70
PID 392 wrote to memory of 1772	392	regsvr32.exe	70
PID 392 wrote to memory of 1772	392	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9_2022-01-25__133446.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9_2022-01-25__133446.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7fc4c8ae3586acb0ca24c982b6133c507f9e40d60f0af174eb91b9260edcd6c9_2022-01-25__133446.dll",DllRegisterServer
    3⤵
    PID:1772

memory/392-116-0x0000000004D70000-0x0000000004D95000-memory.dmp

Download