emotet | 6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674

Analysis

Target
emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
Size 660KB
Sample220126-acl2vsaadk
SHA256 6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674
MD5 429f851befd0f0009692f486a8929442
SHA1 9c122711050a6e243ae1bb348371b04837ddfbff
SHA512 bf799f67fc2a43cad81e3879ba8ebf6f710fd52d81398d8b9885d4ea0a3560dabce615ef67ae46c5a75245428540172de91ad70fa611e7e810339aea41f079b6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1540 wrote to memory of 1912	1540	regsvr32.exe	27
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1348	1912	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll",DllRegisterServer
    3⤵
    PID:1348

memory/1540-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1912-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1912-56-0x0000000000930000-0x0000000000955000-memory.dmp

Download