emotet | 2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d

Analysis

Target
emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
Size 705KB
Sample220127-cjf6asecc9
SHA256 2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d
MD5 7d5cb4c7000d5c9555df391deb6fd750
SHA1 5a73f510620492fb64cc3412000c33f8878ed14b
SHA512 40abb198fde3276b746444072b212c13d401c10e90e16898a11408c2ad3f150cc33c33a4c56243ab8063cbce5d4299d91c0e6bc30551bfda197817e95b43e4a8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 528 wrote to memory of 1684	528	regsvr32.exe	27
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28
PID 1684 wrote to memory of 1884	1684	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll",DllRegisterServer
    3⤵
    PID:1884

memory/528-53-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download

memory/1684-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1684-55-0x00000000002A0000-0x00000000002C5000-memory.dmp

Download