emotet | 8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d

Analysis

Target
emotet_exe_e5_8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d_2022-01-28__074902.dll
Size 638KB
Sample220128-jpdexshhf6
SHA256 8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d
MD5 3222cae009175a140b3407d74a65c16b
SHA1 12701acb3032a5b8496c76d470114585a3c6b130
SHA512 4b0caf7676972c241b5b25bfc7e74e3089c2ef5b2093a3409ca6c49b17d0a3d6d86234f0cd969cd74b6ae14b4a66c4fd3c51203db5c1f4355902815851236b58
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4304	4200	regsvr32.exe	69
PID 4200 wrote to memory of 4304	4200	regsvr32.exe	69
PID 4200 wrote to memory of 4304	4200	regsvr32.exe	69
PID 4304 wrote to memory of 4552	4304	regsvr32.exe	70
PID 4304 wrote to memory of 4552	4304	regsvr32.exe	70
PID 4304 wrote to memory of 4552	4304	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d_2022-01-28__074902.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d_2022-01-28__074902.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8708d5ffad13ddaf78468c5022e925e75a739b2e9accce7ffbf9b3f0c635fe2d_2022-01-28__074902.dll",DllRegisterServer
    3⤵
    PID:4552

memory/4304-116-0x0000000004C70000-0x0000000004C97000-memory.dmp

Download