emotet | 5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9

Analysis

Target
emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
Size 496KB
Sample220127-aebnxacebk
SHA256 5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9
MD5 4e842f85adec639e8cf6e22fcc8eaeae
SHA1 fbddf23670d50136d49bb4e15cd8b89ff7a420ee
SHA512 a1fda8ea97702c268692c44c363aab153091dbf9172e663a542016472b709dc6ee6aa483049ea66eb938d3e49d6c72c5f8b99eb2e71b1848079813b073369c14
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 976 wrote to memory of 1624	976	regsvr32.exe	27
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28
PID 1624 wrote to memory of 864	1624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll",DllRegisterServer
    3⤵
    PID:864

memory/976-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1624-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1624-56-0x0000000000240000-0x0000000000265000-memory.dmp

Download