emotet | bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6

Analysis

Target
emotet_exe_e5_bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6_2022-01-27__162550.dll
Size 520KB
Sample220127-txja9affhn
SHA256 bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6
MD5 ba9ff92bb6a12e591f965e86dfa5c0d6
SHA1 754f437e76823ec8121e3d5f972a1f24463401a0
SHA512 2363bab13e66189412c3f2c0e3c48ab6e6e20204f685616596ae92712c412cdd26407c005316aba56b79c3c8375338bc1cdc5c6300d5df2ef1628210bf6e8ac0
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2612	2424	regsvr32.exe	68
PID 2424 wrote to memory of 2612	2424	regsvr32.exe	68
PID 2424 wrote to memory of 2612	2424	regsvr32.exe	68
PID 2612 wrote to memory of 3112	2612	regsvr32.exe	69
PID 2612 wrote to memory of 3112	2612	regsvr32.exe	69
PID 2612 wrote to memory of 3112	2612	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6_2022-01-27__162550.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6_2022-01-27__162550.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bcc8ad3ebe90f693615c01e2cd9daa2fcc972c4e19be14e6d534b32ae65c8bc6_2022-01-27__162550.dll",DllRegisterServer
    3⤵
    PID:3112

memory/2612-116-0x0000000004E91000-0x0000000004EB4000-memory.dmp

Download