emotet | 70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4

Analysis

Target
emotet_exe_e5_70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4_2022-01-25__171336.dll
Size 596KB
Sample220125-vr1h1sbfam
SHA256 70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4
MD5 5a4d159a696bb94c463430743ad59f78
SHA1 9b5b0eff7dc9a3dad22675e81c8709fb487f9ac9
SHA512 f49f3c687808548c5fc643fe82a138771bd1a0c8b98fc1d809a8fad4a12b4b495aef7885f66f5ea7dd7d9219fe72a9a4743f1815b210118796528b72917ba3e6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69
PID 3808 wrote to memory of 3948	3808	regsvr32.exe	70
PID 3808 wrote to memory of 3948	3808	regsvr32.exe	70
PID 3808 wrote to memory of 3948	3808	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4_2022-01-25__171336.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4_2022-01-25__171336.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_70b39b461db9376235da88484132e8cf403b1845bcaef46ceed8f569b2c5bbf4_2022-01-25__171336.dll",DllRegisterServer
    3⤵
    PID:3948

memory/3808-115-0x0000000004980000-0x00000000049A7000-memory.dmp

Download