emotet | 5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751

Analysis

Target
emotet_exe_e4_5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751_2022-01-28__000426.dll
Size 512KB
Sample220128-adbbraddc7
SHA256 5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751
MD5 97dd49d1b74583081aa8bf187bb7fc24
SHA1 72c2d1427f8e577bd7769e138db6db756c5ebf1e
SHA512 ee46560b5fb1de3c0fc56a108f69b5d319c9de5f34dc07e6d42a1f297ac2095a3d1496f785dad4d25e9742cb30a042ba30c8f9a4e7356d1796ec7e7fe296a055
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1340 wrote to memory of 1656	1340	regsvr32.exe	27
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28
PID 1656 wrote to memory of 520	1656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751_2022-01-28__000426.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751_2022-01-28__000426.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ef5a1d5dc91afe4d9bc137b5c13b32ef737cd6f1a0da0d35c4fff40c22db751_2022-01-28__000426.dll",DllRegisterServer
    3⤵
    PID:520

memory/1340-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1656-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1656-56-0x0000000000220000-0x0000000000245000-memory.dmp

Download