emotet | 567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455

Analysis

Target
emotet_exe_e5_567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455_2022-01-25__171329.dll
Size 596KB
Sample220125-vrzxgsbgh6
SHA256 567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455
MD5 28b47db9206121769517187efb3d1ce6
SHA1 9fd9fe96e7385dfa97acda2639ab3e1fd57ed0a9
SHA512 2d42ab7fe84c17ce77d6232297204f9f2a392934fad685ca7134d5c07aca7ef99ad29f3381471a20c29675a4a3f4774c6e5ee324fb8973969f85c89a1816402f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2780	2452	regsvr32.exe	68
PID 2452 wrote to memory of 2780	2452	regsvr32.exe	68
PID 2452 wrote to memory of 2780	2452	regsvr32.exe	68
PID 2780 wrote to memory of 3032	2780	regsvr32.exe	69
PID 2780 wrote to memory of 3032	2780	regsvr32.exe	69
PID 2780 wrote to memory of 3032	2780	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455_2022-01-25__171329.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455_2022-01-25__171329.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_567df2f56d235245dacb04f901181f3f89163a5bf3e2aab6bc6a111b2e43e455_2022-01-25__171329.dll",DllRegisterServer
    3⤵
    PID:3032

memory/2780-115-0x0000000004270000-0x0000000004297000-memory.dmp

Download