emotet | db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70

Analysis

Target
emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
Size 520KB
Sample220128-abhcaadcf4
SHA256 db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70
MD5 b340186c4e23fa24df1539eb77886c4c
SHA1 417c6025d8347647f553031e5ebf1334ec292b46
SHA512 d5f5813616b115affe55efa422dcdf7d02f19541d73c2c2d8ad2736ca26bf03bd01914a2f49cb32e1bbdda508ff434af97d4d6f9f741681bcee260f787472c11
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 960 wrote to memory of 1620	960	regsvr32.exe	27
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1796	1620	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll",DllRegisterServer
    3⤵
    PID:1796

memory/960-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1620-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1620-56-0x00000000009B0000-0x00000000009D7000-memory.dmp

Download