emotet | d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8

Analysis

Target
emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacegn
SHA256 d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8
MD5 2cbf576361458263d04362124682c178
SHA1 78e5f3bc639957030f93ff10376aeefb9ce0d163
SHA512 bf9672c625cfbbf02d1fc7224c262a6fac010577fa28b7afac617b47f0310f48fa785ecfc9931141c7b9ffc1b1605325321db78aec8088b12337180214308cd0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 744 wrote to memory of 288	744	regsvr32.exe	27
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28
PID 288 wrote to memory of 1816	288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:1816

memory/288-55-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/288-56-0x00000000003C0000-0x00000000003E7000-memory.dmp

Download

memory/744-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download