emotet | bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099

Analysis

Target
emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacha5
SHA256 bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099
MD5 ce1a643504f7c417dc2a9d9f3f328f1e
SHA1 df0c3dd2a1ead04752b479513ea05750b5bf1cf2
SHA512 ad4dbabe977ae6a4cd554df10bae8a6dffef36ef0fccdf9128594c07a87640889914224337e6fb27e1e27b988be1761f7e2bcec60931fc19bbbe9fb22631393e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28
PID 1112 wrote to memory of 672	1112	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:672

memory/1112-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Download

memory/1112-56-0x0000000000990000-0x00000000009B7000-memory.dmp

Download

memory/1916-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download