emotet | a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114

Analysis

Target
emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
Size 504KB
Sample220127-aflv9schb3
SHA256 a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114
MD5 ac6bd403f08b9213d60915036d3eacf0
SHA1 d4eabf97b83b4fcd0909f8ef7eeff463a14d96ee
SHA512 24c9fdbf7ac07c5c2da20b84d6362b97e4598133f86a729ac4d1c97ba3e4eb2e1cf60942b23fbe9e2ebe9562287f0d4c518cd55dd9c9146e36b989b3e2b0fd26
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28
PID 1896 wrote to memory of 592	1896	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:592

memory/1776-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download

memory/1896-55-0x0000000076C61000-0x0000000076C63000-memory.dmp

Download

memory/1896-56-0x00000000001F0000-0x0000000000217000-memory.dmp

Download