emotet | 8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b

Analysis

Target
emotet_exe_e5_8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b_2022-01-28__155943.dll
Size 544KB
Sample220128-tfmx4sgcaj
SHA256 8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b
MD5 1d89c25ba33ed65069156421ba377289
SHA1 78628936c8a188acf118e5a4056f8aa1bb8d03fc
SHA512 23d02d9b79a13eaa36e51d54eea8528b2eefcaa79cfe4740ebdd96019d9bd8ce4fb117034e1aeca34974df85addf2fbf1404817a64f9b892075a9152764e6b6a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 656	4020	regsvr32.exe	69
PID 4020 wrote to memory of 656	4020	regsvr32.exe	69
PID 4020 wrote to memory of 656	4020	regsvr32.exe	69
PID 656 wrote to memory of 3216	656	regsvr32.exe	70
PID 656 wrote to memory of 3216	656	regsvr32.exe	70
PID 656 wrote to memory of 3216	656	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b_2022-01-28__155943.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b_2022-01-28__155943.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8a9cc8e48029a27c59064caa10cc98a403c1cb6474488bf4a9bafa4cd966fd8b_2022-01-28__155943.dll",DllRegisterServer
    3⤵
    PID:3216

memory/656-115-0x0000000000900000-0x0000000000927000-memory.dmp

Download