emotet | ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3

Analysis

Target
emotet_exe_e5_ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3_2022-01-27__000843.dll
Size 504KB
Sample220127-afhhvacefq
SHA256 ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3
MD5 b6764e5ef8a0d714507b3d48e1ceb21d
SHA1 525cb79c215d303e6e835cb07d1bd2c64fd4d8be
SHA512 a56d0095882ebdc4820e7822fe3ac7051dd3ae049f42e404265cf080ca2f8bdca082ef497b5881b2c902213bddef7a704bcdee2771600cebfe013fe753ecf2ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3776	3788	regsvr32.exe	69
PID 3788 wrote to memory of 3776	3788	regsvr32.exe	69
PID 3788 wrote to memory of 3776	3788	regsvr32.exe	69
PID 3776 wrote to memory of 2504	3776	regsvr32.exe	70
PID 3776 wrote to memory of 2504	3776	regsvr32.exe	70
PID 3776 wrote to memory of 2504	3776	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3_2022-01-27__000843.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3_2022-01-27__000843.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ac666a3b53ce6c23c3b07161419e38dfa5fe1ed290cd523bef44af8138bc7ca3_2022-01-27__000843.dll",DllRegisterServer
    3⤵
    PID:2504

memory/3776-116-0x0000000000EF0000-0x0000000000F17000-memory.dmp

Download