emotet | 63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8

Analysis

Target
emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
Size 596KB
Sample220126-aebznsabbl
SHA256 63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8
MD5 2013f2cf5455729ea5b716ce6fe2648a
SHA1 07354ebdce9d12f5b09107d04698cbdd9ae0587d
SHA512 4c10ed698e5dc153e4552081f1c2d8f04ffa3ac605975e63b4b478cebd6713c276601c7acbc36339993326558cedc8248df1bac2e57c3bc5cfd24ce2a681db51
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3860	3548	regsvr32.exe	68
PID 3548 wrote to memory of 3860	3548	regsvr32.exe	68
PID 3548 wrote to memory of 3860	3548	regsvr32.exe	68
PID 3860 wrote to memory of 2764	3860	regsvr32.exe	69
PID 3860 wrote to memory of 2764	3860	regsvr32.exe	69
PID 3860 wrote to memory of 2764	3860	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63cfe027a39d41c329e563f6e53f6833e75a1887c534160156df70b2bbc88dc8_2022-01-26__000604.dll",DllRegisterServer
    3⤵
    PID:2764

memory/3860-118-0x0000000002B10000-0x0000000002B37000-memory.dmp

Download