emotet | 0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7

Analysis

Target
emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacegl
SHA256 0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7
MD5 dfcb9206ecb5750ca46a325b44e526df
SHA1 2ec96bb4c43e4d949cb3d946f0b3670375d985e1
SHA512 7d0e5d752c975290058c3762ce442f20e7cecedc2542460328923f73e557aacd995bfca2b5c2969a9c7e5505453203736800bb3b8bc1b694c7f4de74c941fe14
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3792	2256	regsvr32.exe	69
PID 2256 wrote to memory of 3792	2256	regsvr32.exe	69
PID 2256 wrote to memory of 3792	2256	regsvr32.exe	69
PID 3792 wrote to memory of 3844	3792	regsvr32.exe	70
PID 3792 wrote to memory of 3844	3792	regsvr32.exe	70
PID 3792 wrote to memory of 3844	3792	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0d9b16ba79df214152a46dd250bcf93aea779c9de4f4456b0712ae4bcfeee6e7_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:3844

memory/3792-116-0x0000000000D30000-0x0000000000D57000-memory.dmp

Download