emotet | ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070

Analysis

Target
emotet_exe_e5_ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070_2022-01-26__000606.dll
Size 596KB
Sample220126-aec7qsabcj
SHA256 ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070
MD5 d5e6c5b4a6fa8407c386766b21611889
SHA1 b88516e1ea0d4d9b1ecb454f5c1937ab1965c327
SHA512 d372b8a0f28997a51eaa89840cfc936efe19c2f0a2b4d9b14af24d1ab075fe011a8727acfbcfadac7bbc39f08bf2ad5ca9798b7edf640ec9ce50f3f3e373a7eb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2460 wrote to memory of 2772	2460	regsvr32.exe	68
PID 2772 wrote to memory of 3816	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3816	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3816	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070_2022-01-26__000606.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070_2022-01-26__000606.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac7d4a6d267ed1fef531865ecebd1b0f44374e87cdb0aedd03f0ec310a4c6070_2022-01-26__000606.dll",DllRegisterServer
    3⤵
    PID:3816

memory/2772-119-0x0000000001080000-0x00000000010A7000-memory.dmp

Download