emotet | 025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68

Analysis

Target
emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
Size 512KB
Sample220128-adbbraddc6
SHA256 025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68
MD5 fd6c8744aec782e4722950bad92d4ef4
SHA1 3de490eec9bbdcfbe50dd41f8cc7b8ede4df1638
SHA512 fff547f83342b3b2bf1ea8fff1d4b51aa058416d4e46c5a12b838f8225f08dee9d154961bac65863f302452dcf1fcff21737ee97d6f4fe8c8f9e491dc23b85a1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1880 wrote to memory of 1212	1880	regsvr32.exe	27
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28
PID 1212 wrote to memory of 268	1212	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll",DllRegisterServer
    3⤵
    PID:268

memory/1212-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1212-56-0x0000000000210000-0x0000000000235000-memory.dmp

Download

memory/1880-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download