emotet | 2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e

Analysis

Target
emotet_exe_e4_2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e_2022-01-28__000424.dll
Size 512KB
Sample220128-adbbracgfm
SHA256 2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e
MD5 aa814dae0c7d11712c9e642c263be4e2
SHA1 c3b268b1f6c20053ca2d472adb72a518916a189d
SHA512 ef5a1dfecf0b137f8c8a8f9da9fc0ea77db8de1d4a237b87df8e562d6aedc5e3e14636223cfa2fd881c6a2ce3d0a8790237cdb78e632971fb1515fc30b42c604
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4072 wrote to memory of 816	4072	regsvr32.exe	70
PID 4072 wrote to memory of 816	4072	regsvr32.exe	70
PID 4072 wrote to memory of 816	4072	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e_2022-01-28__000424.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e_2022-01-28__000424.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2f0474bde99563a08aa472ca061531c87ee1d1856908154272b7146f9b01d30e_2022-01-28__000424.dll",DllRegisterServer
    3⤵
    PID:816

memory/4072-117-0x0000000004C00000-0x0000000004C25000-memory.dmp

Download