emotet | 5f76e9a2672725fa60ba0d0409e45a9ee7ddec593b1faab82329b8a5b00d262d

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_115346_PM_CST_2022.dll
Size 660KB
Sample220126-gtvhwshge3
SHA256 5f76e9a2672725fa60ba0d0409e45a9ee7ddec593b1faab82329b8a5b00d262d
MD5 57a7b3d25fff145309d57400a9773581
SHA1 1fc0e0856ab7ebe4313988d57d19f2a56dc867d2
SHA512 3395e7a0d9233315fa46ab6297c5dc11fe4ba0f4551a241f809d88abe1d387d39d3d7ba3c88845369f8ee1d7ed85bca7e8c7b45031e1be248b7d57921c456faa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2684	2696	regsvr32.exe	68
PID 2696 wrote to memory of 2684	2696	regsvr32.exe	68
PID 2696 wrote to memory of 2684	2696	regsvr32.exe	68
PID 2684 wrote to memory of 1004	2684	regsvr32.exe	69
PID 2684 wrote to memory of 1004	2684	regsvr32.exe	69
PID 2684 wrote to memory of 1004	2684	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115346_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115346_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115346_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1004

memory/2684-116-0x0000000004C50000-0x0000000004C75000-memory.dmp

Download