emotet | ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f

Analysis

Target
emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
Size 596KB
Sample220126-aebnxaadf6
SHA256 ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f
MD5 9a23286ba72acc3c4a8ba3ec38877a0d
SHA1 cda65b479a33d74f33813ac3fe7f21a5273996ec
SHA512 fa89c0e265a6ee80974f557ab1bb55d840b5f285614fdaf011c0a340d3cb81afe382e4b0f6b522c57503a43d748af823673a34ea866f40b9505cfe51bb09ec61
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3736	2724	regsvr32.exe	69
PID 2724 wrote to memory of 3736	2724	regsvr32.exe	69
PID 2724 wrote to memory of 3736	2724	regsvr32.exe	69
PID 3736 wrote to memory of 3432	3736	regsvr32.exe	70
PID 3736 wrote to memory of 3432	3736	regsvr32.exe	70
PID 3736 wrote to memory of 3432	3736	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ad8051ea4c0dc500898efe015740845863c4008dfe1b24e2ccd77170440bcc7f_2022-01-26__000604.dll",DllRegisterServer
    3⤵
    PID:3432

memory/3736-119-0x00000000044F0000-0x0000000004517000-memory.dmp

Download