emotet | 69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e

Analysis

Target
emotet_exe_e5_69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e_2022-01-28__074903.dll
Size 638KB
Sample220128-jpdexshhf3
SHA256 69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e
MD5 4ea0ed2eb5c47fb80fd17e2ad578b518
SHA1 15c6f869470f3e603a82e792a4193894be6c5c3d
SHA512 d8ef963ab352ee035b379a10952d405a71f574834e8657915b3fb96563aeeb87a9ee9ad5339ab9a1d7693764e697f800e61e09a475ec43bd34d66569175bd927
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2700	2692	regsvr32.exe	68
PID 2692 wrote to memory of 2700	2692	regsvr32.exe	68
PID 2692 wrote to memory of 2700	2692	regsvr32.exe	68
PID 2700 wrote to memory of 1540	2700	regsvr32.exe	69
PID 2700 wrote to memory of 1540	2700	regsvr32.exe	69
PID 2700 wrote to memory of 1540	2700	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e_2022-01-28__074903.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e_2022-01-28__074903.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_69a1a7510906e8a3201a3340de59546eb3aa923b7a75644420e36051ca95962e_2022-01-28__074903.dll",DllRegisterServer
    3⤵
    PID:1540

memory/2700-116-0x0000000002CD0000-0x0000000002CF7000-memory.dmp

Download