emotet | 89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c

Analysis

Target
emotet_exe_e4_89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c_2022-01-25__133443.dll
Size 588KB
Sample220125-qv9tmsgeen
SHA256 89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c
MD5 92eb618a54fd8c6247b306b002b20f76
SHA1 b40b51faecbee4236db063025bc2e45d4da1b613
SHA512 df96738aa30048c60bc9e8d5d12f17d5e7fe81b2af08c7f0abd86413613ab797232c38d9321148f0c0e3aef43117f926b22f41fa448a766fbaa09f27584daa96
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4192	4196	regsvr32.exe	69
PID 4196 wrote to memory of 4192	4196	regsvr32.exe	69
PID 4196 wrote to memory of 4192	4196	regsvr32.exe	69
PID 4192 wrote to memory of 4048	4192	regsvr32.exe	70
PID 4192 wrote to memory of 4048	4192	regsvr32.exe	70
PID 4192 wrote to memory of 4048	4192	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c_2022-01-25__133443.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c_2022-01-25__133443.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_89fa0e88adebeda00c90641818d07cfbfcebadde91e0e009e9fa16f27fcb394c_2022-01-25__133443.dll",DllRegisterServer
    3⤵
    PID:4048

memory/4192-115-0x0000000000280000-0x00000000002A5000-memory.dmp

Download