emotet | 1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3

Analysis

Target
emotet_exe_e5_1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3_2022-01-27__162549.dll
Size 520KB
Sample220127-txja9affhm
SHA256 1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3
MD5 d341f5b9a7377a3a57c89b446edb6770
SHA1 5942417c128d339e04e9e11f9daa745639482a54
SHA512 145db3b5b7d32c4db2affa83822f016f7e9654d317acb122226d7aefed29a1b18f49f339aaa8561733d4ede7fbb4ba88dc2c4e5129aab77ae18294a9fa192756
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2680	2468	regsvr32.exe	69
PID 2468 wrote to memory of 2680	2468	regsvr32.exe	69
PID 2468 wrote to memory of 2680	2468	regsvr32.exe	69
PID 2680 wrote to memory of 1988	2680	regsvr32.exe	70
PID 2680 wrote to memory of 1988	2680	regsvr32.exe	70
PID 2680 wrote to memory of 1988	2680	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3_2022-01-27__162549.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3_2022-01-27__162549.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1385bfbf90e9dcf37cda4997072ad3e64f89faf7c9ff206848ebb502e21c1eb3_2022-01-27__162549.dll",DllRegisterServer
    3⤵
    PID:1988

memory/2680-118-0x00000000035F0000-0x0000000003617000-memory.dmp

Download