emotet | 632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4

Analysis

Target
emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
Size 629KB
Sample220128-fr3aaagde8
SHA256 632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4
MD5 5af8257bd43830fd59c22c600a1bc497
SHA1 b37fb70c08a4da0101c49afbb001778a9c4f1e29
SHA512 03e03f55b2761979d458980b23d04223f8731d0c5d5cfad1c47358f07f55eff3dfcc2b78e5dd9a0c348adb001fe4685e902c5c174b608b595cdf0c19e26f672e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 1332 wrote to memory of 840	1332	regsvr32.exe	27
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28
PID 840 wrote to memory of 556	840	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll",DllRegisterServer
    3⤵
    PID:556

memory/840-55-0x0000000075471000-0x0000000075473000-memory.dmp

Download

memory/840-56-0x00000000001B0000-0x00000000001D5000-memory.dmp

Download

memory/1332-54-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Download