emotet | e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563

Analysis

Target
emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
Size 496KB
Sample220126-x2nnbahff9
SHA256 e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563
MD5 f349ef64b82f76aa4d2c3fbc8187028e
SHA1 074db9ae6cfa8f3a64489a4969eea465d0fe5636
SHA512 daa71682458f17a23896e83e0903b9e7d9d773f6d45c615939600e68f2255f4a3a62d407b730ca71d8912560701947b8f256c024cd4aa3c00ffa4e58f0ee3ca0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 1700 wrote to memory of 836	1700	regsvr32.exe	27
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28
PID 836 wrote to memory of 1040	836	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll",DllRegisterServer
    3⤵
    PID:1040

memory/836-56-0x0000000075F91000-0x0000000075F93000-memory.dmp

Download

memory/836-57-0x0000000000270000-0x0000000000295000-memory.dmp

Download

memory/1700-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download