emotet | f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc

Analysis

Target
emotet_exe_e5_f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc_2022-01-25__171329.dll
Size 596KB
Sample220125-vrzxgsbegr
SHA256 f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc
MD5 e69139d6955473b9f30b6eeff069704a
SHA1 6fc4ed24ced3738ba082ec1dff5d2643ed253cac
SHA512 b0ba15ec1d68bd859ccca10a61ed57411b41ad27f340e580daecdc138a0645791edbe0005bb44e89dfa3bac8eb51d74470240b92d84a6b2eb5113bbcef627705
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3384	3436	regsvr32.exe	68
PID 3436 wrote to memory of 3384	3436	regsvr32.exe	68
PID 3436 wrote to memory of 3384	3436	regsvr32.exe	68
PID 3384 wrote to memory of 4080	3384	regsvr32.exe	69
PID 3384 wrote to memory of 4080	3384	regsvr32.exe	69
PID 3384 wrote to memory of 4080	3384	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc_2022-01-25__171329.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc_2022-01-25__171329.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f1f09fef2ae5b947f89cfd79e32cc488a85d77dab0289b5a5329d71ddfcf4abc_2022-01-25__171329.dll",DllRegisterServer
    3⤵
    PID:4080

memory/3384-118-0x0000000003390000-0x00000000033B7000-memory.dmp

Download