emotet | bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099

Analysis

Target
emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
Size 504KB
Sample220127-aflkhacha5
SHA256 bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099
MD5 ce1a643504f7c417dc2a9d9f3f328f1e
SHA1 df0c3dd2a1ead04752b479513ea05750b5bf1cf2
SHA512 ad4dbabe977ae6a4cd554df10bae8a6dffef36ef0fccdf9128594c07a87640889914224337e6fb27e1e27b988be1761f7e2bcec60931fc19bbbe9fb22631393e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3912	3784	regsvr32.exe	68
PID 3784 wrote to memory of 3912	3784	regsvr32.exe	68
PID 3784 wrote to memory of 3912	3784	regsvr32.exe	68
PID 3912 wrote to memory of 520	3912	regsvr32.exe	69
PID 3912 wrote to memory of 520	3912	regsvr32.exe	69
PID 3912 wrote to memory of 520	3912	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bf7fab32e7385e89f817227618de4dced1685083cff588b9d114d0deb9c97099_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:520

memory/3912-118-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Download