emotet | c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2

Analysis

Target
emotet_exe_e5_c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2_2022-01-26__000605.dll
Size 596KB
Sample220126-aecafaadg3
SHA256 c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2
MD5 6e076ca90279fa870e98a87044ab7409
SHA1 be45e3d112db67914eecb1ad30746cb0a40e4d43
SHA512 38ad02fd8ee04c7e8d631e59daf5d4516b731dcec86603a4c39178a29b6ac465c0ac95503fd6321886aa0d1cfebcfec0391408259005344e126274b5552561f2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 676	3464	regsvr32.exe	68
PID 3464 wrote to memory of 676	3464	regsvr32.exe	68
PID 3464 wrote to memory of 676	3464	regsvr32.exe	68
PID 676 wrote to memory of 840	676	regsvr32.exe	69
PID 676 wrote to memory of 840	676	regsvr32.exe	69
PID 676 wrote to memory of 840	676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2_2022-01-26__000605.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2_2022-01-26__000605.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c184dc6ba80e12d4429385cd1ff1e4db1b63273774e170de5fa636bf591b3ac2_2022-01-26__000605.dll",DllRegisterServer
    3⤵
    PID:840

memory/676-118-0x0000000004A00000-0x0000000004A27000-memory.dmp

Download