emotet | d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd

Analysis

Target
emotet_exe_e4_d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd_2022-01-28__000424.dll
Size 512KB
Sample220128-adbbraddc5
SHA256 d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd
MD5 d84881bf79a1e2d003a8f7163e7e3f2b
SHA1 811d896b7c1bba27bbcea691c954fad0f41e2ced
SHA512 7a0308e08fdb7f6bfe54069c37736419e17cfc770f4c0af4e9c09104835f4e8dd420657b94988fede7ad0f7dab5b23f8bf533df0d83599aa28dbce5a65c2743e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd_2022-01-28__000424.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd_2022-01-28__000424.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d37045e23a5fda024254f82e73a1e264de1d748b22c69ea5c9ad600a7b5e95cd_2022-01-28__000424.dll",DllRegisterServer
    3⤵
    PID:524

memory/1704-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

Download

memory/1880-55-0x0000000076001000-0x0000000076003000-memory.dmp

Download

memory/1880-57-0x00000000005F0000-0x0000000000615000-memory.dmp

Download