emotet | 6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674

Analysis

Target
emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
Size 660KB
Sample220126-acl2vsaadk
SHA256 6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674
MD5 429f851befd0f0009692f486a8929442
SHA1 9c122711050a6e243ae1bb348371b04837ddfbff
SHA512 bf799f67fc2a43cad81e3879ba8ebf6f710fd52d81398d8b9885d4ea0a3560dabce615ef67ae46c5a75245428540172de91ad70fa611e7e810339aea41f079b6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3592	3644	regsvr32.exe	68
PID 3644 wrote to memory of 3592	3644	regsvr32.exe	68
PID 3644 wrote to memory of 3592	3644	regsvr32.exe	68
PID 3592 wrote to memory of 4148	3592	regsvr32.exe	69
PID 3592 wrote to memory of 4148	3592	regsvr32.exe	69
PID 3592 wrote to memory of 4148	3592	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6d2e644e4bac70cf4ed191d1bf56f3fcfdabfffeca94887791751b9f5d502674_2022-01-26__000332.dll",DllRegisterServer
    3⤵
    PID:4148

memory/3592-118-0x0000000000160000-0x0000000000185000-memory.dmp

Download