emotet | 25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81

Analysis

Target
emotet_exe_e4_25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81_2022-01-25__151737.dll
Size 660KB
Sample220125-spl7haaaf7
SHA256 25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81
MD5 b6b9716cc21fc481d3d21218c5e9777c
SHA1 1bbc1a9e7e264372024b727680cf253122d07ea8
SHA512 3ba2d26e2367b90b5fc432ec193cfa0c0736db9162edd6ec847c8d426336db5ba6821b0120622ccab08ffe9f0780ae48ab6b7c94c627974ee9eda105f6ee2702
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2716	2676	regsvr32.exe	68
PID 2676 wrote to memory of 2716	2676	regsvr32.exe	68
PID 2676 wrote to memory of 2716	2676	regsvr32.exe	68
PID 2716 wrote to memory of 3152	2716	regsvr32.exe	69
PID 2716 wrote to memory of 3152	2716	regsvr32.exe	69
PID 2716 wrote to memory of 3152	2716	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81_2022-01-25__151737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81_2022-01-25__151737.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_25b4f65f86eb58fb63a08afd03533d4b4cda6f02a0fc6621cd6c2da247c12c81_2022-01-25__151737.dll",DllRegisterServer
    3⤵
    PID:3152

memory/2716-118-0x0000000004BF0000-0x0000000004C15000-memory.dmp

Download