emotet | 369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079

Analysis

Target
emotet_exe_e5_369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079_2022-01-28__074906.dll
Size 638KB
Sample220128-jpdexshhf7
SHA256 369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079
MD5 9e507d35df275e7ab365bef8e63e31b2
SHA1 bf69bd42c26c1f6a9569d3e80564b04375d96166
SHA512 ac694f46b62baf0e4922ad0c1f57f6c8ffa9d1ad546efb760a8a00c145c43ce49e2b1f18b62d84f0231267d4b7919211e45fd387632609103603bfb9e9a100fe
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 756	3468	regsvr32.exe	68
PID 3468 wrote to memory of 756	3468	regsvr32.exe	68
PID 3468 wrote to memory of 756	3468	regsvr32.exe	68
PID 756 wrote to memory of 3388	756	regsvr32.exe	69
PID 756 wrote to memory of 3388	756	regsvr32.exe	69
PID 756 wrote to memory of 3388	756	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079_2022-01-28__074906.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079_2022-01-28__074906.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_369f0f9060ba6ce21caeefdc8433190a7065d8c53f2b14dfca65900ea75b4079_2022-01-28__074906.dll",DllRegisterServer
    3⤵
    PID:3388

memory/756-118-0x0000000002C80000-0x0000000002CA7000-memory.dmp

Download