emotet | bdb83bf2b688ddff085a2c1c0eeb7100246a4e83caf789c39e72bf2321eebf82

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_115336_PM_CST_2022.dll
Size 660KB
Sample220126-gs8dcshgd6
SHA256 bdb83bf2b688ddff085a2c1c0eeb7100246a4e83caf789c39e72bf2321eebf82
MD5 b693acd483de4730faafb7196a999810
SHA1 bbdb3d0f445a6161b6f10ed0de6a0eca5f8a25ac
SHA512 f57314bbc40547987e95cfdfb2ca0b11954ad7d5c7ec935ee47f463beb0097429d0a450c7f5aaa800571147c952fe84c9ae685c88782403907a1e7528c3662f8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 388	3692	regsvr32.exe	69
PID 3692 wrote to memory of 388	3692	regsvr32.exe	69
PID 3692 wrote to memory of 388	3692	regsvr32.exe	69
PID 388 wrote to memory of 1000	388	regsvr32.exe	70
PID 388 wrote to memory of 1000	388	regsvr32.exe	70
PID 388 wrote to memory of 1000	388	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115336_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115336_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115336_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1000

memory/388-118-0x0000000002ED0000-0x0000000002EF5000-memory.dmp

Download