emotet | 78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a

Analysis

Target
emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
Size 596KB
Sample220125-vrz79abehp
SHA256 78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a
MD5 e71c860bd5d0353cf79780cb49fd80e1
SHA1 8a97c1c30726249d1470796052ecc1bf749f1874
SHA512 df980034cec0a952b2b2861de05689a53e0bbed998be81a5eead0223f120585a2788018661f786ef20eedd9589fea2e714d22102262602d23eb318471d5ad4b3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1292 wrote to memory of 1588	1292	regsvr32.exe	27
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1028	1588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll",DllRegisterServer
    3⤵
    PID:1028

memory/1292-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Download

memory/1588-55-0x0000000076151000-0x0000000076153000-memory.dmp

Download

memory/1588-56-0x0000000000140000-0x0000000000167000-memory.dmp

Download