emotet | 2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d

Analysis

Target
emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
Size 705KB
Sample220127-cjf6asecc9
SHA256 2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d
MD5 7d5cb4c7000d5c9555df391deb6fd750
SHA1 5a73f510620492fb64cc3412000c33f8878ed14b
SHA512 40abb198fde3276b746444072b212c13d401c10e90e16898a11408c2ad3f150cc33c33a4c56243ab8063cbce5d4299d91c0e6bc30551bfda197817e95b43e4a8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2704	2628	regsvr32.exe	68
PID 2628 wrote to memory of 2704	2628	regsvr32.exe	68
PID 2628 wrote to memory of 2704	2628	regsvr32.exe	68
PID 2704 wrote to memory of 2260	2704	regsvr32.exe	69
PID 2704 wrote to memory of 2260	2704	regsvr32.exe	69
PID 2704 wrote to memory of 2260	2704	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2c04ef0df38786dd0b00ce3973f00d5b4bee7567cf10bdafab9fdfb9ab93582d_2022-01-27__020517.dll",DllRegisterServer
    3⤵
    PID:2260

memory/2704-115-0x0000000004F40000-0x0000000004F65000-memory.dmp

Download