emotet | cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927

Analysis

Target
emotet_exe_e4_cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927_2022-01-28__050650.dll
Size 629KB
Sample220128-fr2zhsfhbp
SHA256 cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927
MD5 8632a854ae2fe1db16de72985c03f8a6
SHA1 3bb3b495ae49cb867871241909fd930074633ee3
SHA512 722e927cf5c4912dda554a080de95fbae184d7a240b091bc0173d6b5762d89157ee4f67bc213c56a1e48b02f099170b3e0222d858eff87fa227b55a8aec9af00
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3980	2644	regsvr32.exe	68
PID 2644 wrote to memory of 3980	2644	regsvr32.exe	68
PID 2644 wrote to memory of 3980	2644	regsvr32.exe	68
PID 3980 wrote to memory of 1004	3980	regsvr32.exe	69
PID 3980 wrote to memory of 1004	3980	regsvr32.exe	69
PID 3980 wrote to memory of 1004	3980	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927_2022-01-28__050650.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927_2022-01-28__050650.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cd52ef71bd183f9e8662f94c08a05f667ee4c0f7c38899f6d3d7a2143c95e927_2022-01-28__050650.dll",DllRegisterServer
    3⤵
    PID:1004

memory/3980-118-0x0000000004C70000-0x0000000004C95000-memory.dmp

Download