emotet | 0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c

Analysis

Target
emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
Size 588KB
Sample220125-qv9hwaggf8
SHA256 0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c
MD5 a1988bcfb411a72de2d5bcbe24530521
SHA1 b90fc72c20c0fb655a40f840423a3a7de0b15efa
SHA512 d05627278a8f3d94eedab0551f52533c510de632210c46d588897b923d1985bed0d013cca19f3dbc39411fabb47b3664646ead3bf7e4bf1a4aba98f528607980
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 1520 wrote to memory of 964	1520	regsvr32.exe	27
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28
PID 964 wrote to memory of 524	964	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll",DllRegisterServer
    3⤵
    PID:524

memory/964-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/964-56-0x0000000001DA0000-0x0000000001DC5000-memory.dmp

Download

memory/1520-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download