emotet | 2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da

Analysis

Target
emotet_exe_e4_2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da_2022-01-27__000622.dll
Size 496KB
Sample220127-aebnxacgd2
SHA256 2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da
MD5 62e0c8828b11fcd15423674f65150cf3
SHA1 6f9eab8506c7252c5eff3953f5eb1775df7b5c12
SHA512 7433db7bb3687f421d25eade41b735cef7614a79f8bdd64ab1cfd5975b5635bbe22a3eccf039be4ecca253fa50a8c0609e93dec474300323c77ca9d826f1c9fa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2772	2776	regsvr32.exe	68
PID 2776 wrote to memory of 2772	2776	regsvr32.exe	68
PID 2776 wrote to memory of 2772	2776	regsvr32.exe	68
PID 2772 wrote to memory of 1884	2772	regsvr32.exe	69
PID 2772 wrote to memory of 1884	2772	regsvr32.exe	69
PID 2772 wrote to memory of 1884	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da_2022-01-27__000622.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da_2022-01-27__000622.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2dec67697514252cde4d780bd3903f792e3bdd05b407ec6bf99d757fa10b25da_2022-01-27__000622.dll",DllRegisterServer
    3⤵
    PID:1884

memory/2772-115-0x0000000004F00000-0x0000000004F25000-memory.dmp

Download