emotet | f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81

Analysis

Target
emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
Size 496KB
Sample220127-aecafacecn
SHA256 f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81
MD5 1383264a2725bc286f73adc16e5f95d2
SHA1 0ec45f3258563548477208424aa229c63b08754f
SHA512 67af11d4835655f76f11df253dead45daa200ab243061225758eb710d079b0d617392153ed2e86c8b968ada18f23aa7ffe3aaa3a7ea30b2432835afb675d01fd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 1848 wrote to memory of 524	1848	regsvr32.exe	27
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28
PID 524 wrote to memory of 792	524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll",DllRegisterServer
    3⤵
    PID:792

memory/524-55-0x0000000075891000-0x0000000075893000-memory.dmp

Download

memory/524-56-0x00000000001A0000-0x00000000001C5000-memory.dmp

Download

memory/1848-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Download