emotet | f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81

Analysis

Target
emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
Size 496KB
Sample220127-aecafacecn
SHA256 f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81
MD5 1383264a2725bc286f73adc16e5f95d2
SHA1 0ec45f3258563548477208424aa229c63b08754f
SHA512 67af11d4835655f76f11df253dead45daa200ab243061225758eb710d079b0d617392153ed2e86c8b968ada18f23aa7ffe3aaa3a7ea30b2432835afb675d01fd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3780	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3780	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3780	3068	regsvr32.exe	69
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	70
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	70
PID 3780 wrote to memory of 3920	3780	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f23f8683f54c45946ff248bb9b0d35726770a9f7d29edcac907cbc7cf7433c81_2022-01-27__000630.dll",DllRegisterServer
    3⤵
    PID:3920

memory/3780-118-0x0000000004780000-0x00000000047A5000-memory.dmp

Download