emotet | 371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d

Analysis

Target
emotet_exe_e5_371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d_2022-01-25__171329.dll
Size 596KB
Sample220125-vrz79abehn
SHA256 371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d
MD5 1ec1426c540250912a7aa6bf9899d736
SHA1 f1b04338c9c7454110a346805d6627ada32407c8
SHA512 9ce01f9ce4226566d495028cda2df02b459529c2ca173296ecde3b7c8b8eb8640fbcf9f1788c20b190b95f2a232bbcbcaeaa415f356a1ccfe4c79d1549674334
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3016	2780	regsvr32.exe	68
PID 2780 wrote to memory of 3016	2780	regsvr32.exe	68
PID 2780 wrote to memory of 3016	2780	regsvr32.exe	68
PID 3016 wrote to memory of 3108	3016	regsvr32.exe	69
PID 3016 wrote to memory of 3108	3016	regsvr32.exe	69
PID 3016 wrote to memory of 3108	3016	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d_2022-01-25__171329.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d_2022-01-25__171329.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_371f75df743f39477ff4b1c9b32dac5603d663effce3d1f372f1cf2023b03e8d_2022-01-25__171329.dll",DllRegisterServer
    3⤵
    PID:3108

memory/3016-118-0x0000000003570000-0x0000000003597000-memory.dmp

Download