emotet | 1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022

Analysis

Target
emotet_exe_e5_1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022_2022-01-26__000606.dll
Size 596KB
Sample220126-aec7qsadh3
SHA256 1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022
MD5 343e780cb9d7300d9ee99aee1f94520f
SHA1 c63302baacd644dc4a30dd16cbaf358fb71d7bc1
SHA512 d767e76063dd1a81593d2f2c88997b8dcf08191afa8a4373eb5ee3a1b196743094d5c0d4c124ccadbeda6c6c8e2ba98176b17c150eb9087febf73dda12005080
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2644	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2644	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2644	2460	regsvr32.exe	69
PID 2644 wrote to memory of 2688	2644	regsvr32.exe	70
PID 2644 wrote to memory of 2688	2644	regsvr32.exe	70
PID 2644 wrote to memory of 2688	2644	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022_2022-01-26__000606.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022_2022-01-26__000606.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1e26643aa6cf78b22eede9f8af795e98ff307bf28db99e8dfa4ba913f6f3c022_2022-01-26__000606.dll",DllRegisterServer
    3⤵
    PID:2688

memory/2644-118-0x0000000004C80000-0x0000000004CA7000-memory.dmp

Download