emotet | 7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2

Analysis

Target
emotet_exe_e5_7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2_2022-01-28__074901.dll
Size 638KB
Sample220128-jpdexshhe9
SHA256 7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2
MD5 968736c645769827b57db18c202440e2
SHA1 461ac2cee5fe952e6b3a966b070d5e0dc0dec2ae
SHA512 6d23e2fa04c675a91dc8a20e5b23fe8b5582ddb0a1d5dedd81a3af3211951aceb2206e3e79d1315181fb66ff1a1dc2ff824d3be53cbee9641ac6b4d5e750d491
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3092	3140	regsvr32.exe	68
PID 3140 wrote to memory of 3092	3140	regsvr32.exe	68
PID 3140 wrote to memory of 3092	3140	regsvr32.exe	68
PID 3092 wrote to memory of 3304	3092	regsvr32.exe	69
PID 3092 wrote to memory of 3304	3092	regsvr32.exe	69
PID 3092 wrote to memory of 3304	3092	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2_2022-01-28__074901.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2_2022-01-28__074901.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7c2b4930bffd2523ea835a7a7f646ed1f7638279eaf3356afdb11e10ff7c8ac2_2022-01-28__074901.dll",DllRegisterServer
    3⤵
    PID:3304

memory/3092-118-0x0000000000A90000-0x0000000000AB7000-memory.dmp

Download