emotet | 0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7

Analysis

Target
emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacegl
SHA256 0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7
MD5 dfcb9206ecb5750ca46a325b44e526df
SHA1 2ec96bb4c43e4d949cb3d946f0b3670375d985e1
SHA512 7d0e5d752c975290058c3762ce442f20e7cecedc2542460328923f73e557aacd995bfca2b5c2969a9c7e5505453203736800bb3b8bc1b694c7f4de74c941fe14
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1656	1204	regsvr32.exe	27
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:520

memory/1204-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1656-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1656-56-0x00000000001A0000-0x00000000001C7000-memory.dmp

Download