emotet | 63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8

Analysis

Target
emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
Size 596KB
Sample220126-aebznsabbl
SHA256 63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8
MD5 2013f2cf5455729ea5b716ce6fe2648a
SHA1 07354ebdce9d12f5b09107d04698cbdd9ae0587d
SHA512 4c10ed698e5dc153e4552081f1c2d8f04ffa3ac605975e63b4b478cebd6713c276601c7acbc36339993326558cedc8248df1bac2e57c3bc5cfd24ce2a681db51
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 1580 wrote to memory of 808	1580	regsvr32.exe	27
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28
PID 808 wrote to memory of 1924	808	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll",DllRegisterServer
    3⤵
    PID:1924

memory/808-55-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/808-56-0x0000000000370000-0x0000000000397000-memory.dmp

Download

memory/1580-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download