emotet | 53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063

Analysis

Target
emotet_exe_e4_53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063_2022-01-25__133439.dll
Size 588KB
Sample220125-qv95eaggh3
SHA256 53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063
MD5 93593c93c13955e56d81982b18bc5432
SHA1 1511c1bc9bb89dd39338765ee689f5a0e49f376f
SHA512 68ed8cf1d6422004e08c3828c7fe4de9b57f0fabbab1b76d5d00a34deb6f8a5520c6fb6207cce67844167204163806bd5333eae4d4a875c996c6656d64da0c26
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2796	2728	regsvr32.exe	69
PID 2728 wrote to memory of 2796	2728	regsvr32.exe	69
PID 2728 wrote to memory of 2796	2728	regsvr32.exe	69
PID 2796 wrote to memory of 3452	2796	regsvr32.exe	70
PID 2796 wrote to memory of 3452	2796	regsvr32.exe	70
PID 2796 wrote to memory of 3452	2796	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063_2022-01-25__133439.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063_2022-01-25__133439.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_53a95f8632dc9ec20bcd967c6af50679b17238420204d4e62898ff8b71c43063_2022-01-25__133439.dll",DllRegisterServer
    3⤵
    PID:3452

memory/2796-115-0x0000000002D10000-0x0000000002D35000-memory.dmp

Download