emotet | 3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3

Analysis

Target
emotet_exe_e5_3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3_2022-01-25__171333.dll
Size 596KB
Sample220125-vrz79abgh8
SHA256 3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3
MD5 a22dd20abf17ab9f83012d3d95cd761c
SHA1 4adabaa8dad2729b8493bd1901bc161d758e8b01
SHA512 4440a0bcdffbee487b65a226a3665caa59f5729ac578d0a223cc5d78234e6e75df3faa3d2c58b7cb56515233533d33cad21ff77eedcab113b755f85ac3fea0a4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 3764	3968	regsvr32.exe	69
PID 3968 wrote to memory of 3764	3968	regsvr32.exe	69
PID 3968 wrote to memory of 3764	3968	regsvr32.exe	69
PID 3764 wrote to memory of 548	3764	regsvr32.exe	70
PID 3764 wrote to memory of 548	3764	regsvr32.exe	70
PID 3764 wrote to memory of 548	3764	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3_2022-01-25__171333.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3_2022-01-25__171333.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3dc44ffcf18d1a5ea5a2f1e4eeb63996072cc91be5fe25eeba1c7c1cadede6b3_2022-01-25__171333.dll",DllRegisterServer
    3⤵
    PID:548

memory/3764-115-0x0000000004B00000-0x0000000004B27000-memory.dmp

Download