emotet | e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19

Analysis

Target
emotet_exe_e4_e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19_2022-01-28__000424.dll
Size 512KB
Sample220128-adbbraddd2
SHA256 e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19
MD5 cbe9ce8b3aad637c4699ecbec1d2ad79
SHA1 d848331284f3816447b50ab298bc1304d2dcd950
SHA512 157c165e873c5ac56b66e8fbc22ffb586658492a797ea6aca9ef7ebfa3bbbe81e091c202590523032e55d46c57e6c5bc379c310da20a50e0f3f5526dc6bc8afe
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28
PID 1224 wrote to memory of 528	1224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19_2022-01-28__000424.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19_2022-01-28__000424.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e312a55e4ee8754c770dfb56f784ee01c3082041b0fe797cd2d53c4f8277da19_2022-01-28__000424.dll",DllRegisterServer
    3⤵
    PID:528

memory/1224-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1224-56-0x0000000000290000-0x00000000002B5000-memory.dmp

Download

memory/1900-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download