emotet | 10ee631e59d20920cb45925351c5cc5403dde2f06bdc87cde5f093ddd7c7472e

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_114703_PM_CST_2022.dll
Size 596KB
Sample220126-gsl55aheen
SHA256 10ee631e59d20920cb45925351c5cc5403dde2f06bdc87cde5f093ddd7c7472e
MD5 ed5cae32a3022b05cdd7e71fbd60e92c
SHA1 0928481ae43475e36973733da51fa1c4cae5ddd9
SHA512 099b9f27b566c14f5f087aa7fa0ed8a835e57e838f7dee41ef1a9ab93edcd516f8f6a8ec5f826c386956615e72421662a128e3e866a9f26f835392d24625a00f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3484	3436	regsvr32.exe	68
PID 3436 wrote to memory of 3484	3436	regsvr32.exe	68
PID 3436 wrote to memory of 3484	3436	regsvr32.exe	68
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69
PID 3484 wrote to memory of 3808	3484	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114703_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114703_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114703_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:3808

memory/3484-119-0x00000000030C0000-0x00000000030E7000-memory.dmp

Download