emotet | ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5

Analysis

Target
emotet_exe_e5_ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5_2022-01-28__074904.dll
Size 638KB
Sample220128-jpdexshhf5
SHA256 ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5
MD5 29227d9f301f1201b3ece87aea2ccf02
SHA1 2c7ef5edb1f208f471634a0a9fad5dff16b3d2bc
SHA512 84a86bfb90f0e11ad8a714790d607dc150be0338b6487bed7482f56def35a5c0728910bcf4d5359dd20f28c0b953f77f23d7a4f84f9950486169f79436954375
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1376	596	regsvr32.exe	69
PID 596 wrote to memory of 1376	596	regsvr32.exe	69
PID 596 wrote to memory of 1376	596	regsvr32.exe	69
PID 1376 wrote to memory of 952	1376	regsvr32.exe	70
PID 1376 wrote to memory of 952	1376	regsvr32.exe	70
PID 1376 wrote to memory of 952	1376	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5_2022-01-28__074904.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5_2022-01-28__074904.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ddd766d26b64754a828652f50c475375cfe0a0e07e111968c2c2f53ba1bd52b5_2022-01-28__074904.dll",DllRegisterServer
    3⤵
    PID:952

memory/1376-119-0x0000000004A20000-0x0000000004A47000-memory.dmp

Download