emotet | 11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f

Analysis

Target
emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
Size 496KB
Sample220127-aebznscgd8
SHA256 11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f
MD5 a5d7e3ec561ca8512b428eb635999830
SHA1 bfea00f30424ce0176885c3e578ce276088cc712
SHA512 a487e9565a5d44865ac51ea7eb0cc56411d89cea02a29dc2589ace0d9dfcc969eb6da7ae305b55eccfe54d5cb1b10ce2c63a5c6b47c822c8e96a59526830641f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 352	3552	regsvr32.exe	68
PID 3552 wrote to memory of 352	3552	regsvr32.exe	68
PID 3552 wrote to memory of 352	3552	regsvr32.exe	68
PID 352 wrote to memory of 3056	352	regsvr32.exe	69
PID 352 wrote to memory of 3056	352	regsvr32.exe	69
PID 352 wrote to memory of 3056	352	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll",DllRegisterServer
    3⤵
    PID:3056

memory/352-115-0x0000000000B60000-0x0000000000B85000-memory.dmp

Download