emotet | d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8

Analysis

Target
emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacegn
SHA256 d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8
MD5 2cbf576361458263d04362124682c178
SHA1 78e5f3bc639957030f93ff10376aeefb9ce0d163
SHA512 bf9672c625cfbbf02d1fc7224c262a6fac010577fa28b7afac617b47f0310f48fa785ecfc9931141c7b9ffc1b1605325321db78aec8088b12337180214308cd0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2724	2632	regsvr32.exe	68
PID 2632 wrote to memory of 2724	2632	regsvr32.exe	68
PID 2632 wrote to memory of 2724	2632	regsvr32.exe	68
PID 2724 wrote to memory of 3796	2724	regsvr32.exe	69
PID 2724 wrote to memory of 3796	2724	regsvr32.exe	69
PID 2724 wrote to memory of 3796	2724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d15ccfcd5634089ea8cb51aa08125e170a3f1de17aa8be6ddf6ba1e4333792a8_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:3796

memory/2724-116-0x0000000004560000-0x0000000004587000-memory.dmp

Download