emotet | 025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68

Analysis

Target
emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
Size 512KB
Sample220128-adbbraddc6
SHA256 025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68
MD5 fd6c8744aec782e4722950bad92d4ef4
SHA1 3de490eec9bbdcfbe50dd41f8cc7b8ede4df1638
SHA512 fff547f83342b3b2bf1ea8fff1d4b51aa058416d4e46c5a12b838f8225f08dee9d154961bac65863f302452dcf1fcff21737ee97d6f4fe8c8f9e491dc23b85a1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3716	3424	regsvr32.exe	68
PID 3424 wrote to memory of 3716	3424	regsvr32.exe	68
PID 3424 wrote to memory of 3716	3424	regsvr32.exe	68
PID 3716 wrote to memory of 1360	3716	regsvr32.exe	69
PID 3716 wrote to memory of 1360	3716	regsvr32.exe	69
PID 3716 wrote to memory of 1360	3716	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_025a245e9978ea3a0fb163650ad78df143388cb33d1f0deb6669ecd7c41afd68_2022-01-28__000425.dll",DllRegisterServer
    3⤵
    PID:1360

memory/3716-116-0x0000000004EF0000-0x0000000004F15000-memory.dmp

Download