emotet | d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099

Analysis

Target
emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
Size 496KB
Sample220127-aebznscebq
SHA256 d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099
MD5 635cf952975744e842512b119feb5837
SHA1 49475526bdf74aff39e32b727390b07a66a6a66c
SHA512 906514348c90cd3356f100271c7e7c2aef96b6716ea6d14c3bebb611b7b06951c018a5e87ab6cb2b84049dc35eb5108a468ed074a7e381f045385ebdfbf64270
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 980 wrote to memory of 1068	980	regsvr32.exe	27
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28
PID 1068 wrote to memory of 672	1068	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll",DllRegisterServer
    3⤵
    PID:672

memory/980-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download

memory/1068-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1068-56-0x00000000002F0000-0x0000000000315000-memory.dmp

Download