emotet | 87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40

Analysis

Target
emotet_exe_e4_87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40_2022-01-26__134615.dll
Size 705KB
Sample220126-q3k59addbk
SHA256 87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40
MD5 d79e06f71854bc18180cc024bb773ada
SHA1 6c94c0d27fcd5ba271f446283c338c24620fb7d7
SHA512 370f1ab8d20f8b0a9063acaa4d19a60f7806a102705fb1e1dd0482a7738315bbfac4e4545094dac4d83d2329d84f5f171eec3e9c6bc618f885f692a7b651c559
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3544	4208	regsvr32.exe	68
PID 4208 wrote to memory of 3544	4208	regsvr32.exe	68
PID 4208 wrote to memory of 3544	4208	regsvr32.exe	68
PID 3544 wrote to memory of 3588	3544	regsvr32.exe	69
PID 3544 wrote to memory of 3588	3544	regsvr32.exe	69
PID 3544 wrote to memory of 3588	3544	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40_2022-01-26__134615.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40_2022-01-26__134615.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_87f3625c6983449558ea77be254798135e74db28f35f910dc24e0df444b86c40_2022-01-26__134615.dll",DllRegisterServer
    3⤵
    PID:3588

memory/3544-115-0x0000000004B70000-0x0000000004B95000-memory.dmp

Download