emotet | ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f

Analysis

Target
emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
Size 596KB
Sample220126-aebnxaadf6
SHA256 ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f
MD5 9a23286ba72acc3c4a8ba3ec38877a0d
SHA1 cda65b479a33d74f33813ac3fe7f21a5273996ec
SHA512 fa89c0e265a6ee80974f557ab1bb55d840b5f285614fdaf011c0a340d3cb81afe382e4b0f6b522c57503a43d748af823673a34ea866f40b9505cfe51bb09ec61
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1144 wrote to memory of 1404	1144	regsvr32.exe	27
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28
PID 1404 wrote to memory of 724	1404	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll",DllRegisterServer
    3⤵
    PID:724

memory/1144-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Download

memory/1404-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/1404-56-0x0000000000360000-0x0000000000387000-memory.dmp

Download