emotet | 40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88

Analysis

Target
emotet_exe_e4_40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88_2022-01-25__151737.dll
Size 660KB
Sample220125-spl7hahgbp
SHA256 40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88
MD5 6c3938915f035ec008fe8005cf935986
SHA1 a0f85867dc21acae465c90518d76e6489b4a7c9d
SHA512 e5d179636e383109fdab53c8929c4918bc3fbe9e2a99da879f47546540c98df2ee44b9f72004ce18ea7ad78fbe2bafbd6fedaa9439d360f8ef647f45ad738a24
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2840	2620	regsvr32.exe	68
PID 2620 wrote to memory of 2840	2620	regsvr32.exe	68
PID 2620 wrote to memory of 2840	2620	regsvr32.exe	68
PID 2840 wrote to memory of 592	2840	regsvr32.exe	69
PID 2840 wrote to memory of 592	2840	regsvr32.exe	69
PID 2840 wrote to memory of 592	2840	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88_2022-01-25__151737.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88_2022-01-25__151737.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_40a8a970f85a061bb895e0571358794dc779a13becb1e8bd35b9919d752e9d88_2022-01-25__151737.dll",DllRegisterServer
    3⤵
    PID:592

memory/2840-116-0x0000000000820000-0x0000000000845000-memory.dmp

Download