emotet | 222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d

Analysis

Target
emotet_exe_e4_222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d_2022-01-25__133439.dll
Size 588KB
Sample220125-qv9hwaggf5
SHA256 222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d
MD5 22c6c1d38507b9f4412571d23141677d
SHA1 81ac0353945d73d0ba6e9b9cb4ced7744a7a1aea
SHA512 92c61604450f8e53051e8bf0beca01db27643677a8a6811ce626bd9e435583afe5d71c8b3c4f83fb6297b640edd44339f0d9137c4eb229459ad04f0dd9905b3a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2640	2596	regsvr32.exe	68
PID 2596 wrote to memory of 2640	2596	regsvr32.exe	68
PID 2596 wrote to memory of 2640	2596	regsvr32.exe	68
PID 2640 wrote to memory of 1868	2640	regsvr32.exe	69
PID 2640 wrote to memory of 1868	2640	regsvr32.exe	69
PID 2640 wrote to memory of 1868	2640	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d_2022-01-25__133439.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d_2022-01-25__133439.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_222ad893e2d0bcbc52b40e3e55a2aae14d5a68fe389cc585718b623a4d37925d_2022-01-25__133439.dll",DllRegisterServer
    3⤵
    PID:1868

memory/2640-116-0x0000000004E80000-0x0000000004EA5000-memory.dmp

Download