emotet | 3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c

Analysis

Target
emotet_exe_e5_3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c_2022-01-29__000243.dll
Size 544KB
Sample220129-ab2qxshba7
SHA256 3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c
MD5 b4d7fb22c02a862f8b795e748182a6e3
SHA1 0c9fc97cdf59c1547358a3d4cb5ab2c2af497535
SHA512 ceedb1461626907412c091c4014c7c78ad2ccd0edf1b3280aea90a852afdaaf6ce5b5bd51baaf79126856ad245c6854e2c295301733c3540fd581beb98ced101
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3516	3336	regsvr32.exe	68
PID 3336 wrote to memory of 3516	3336	regsvr32.exe	68
PID 3336 wrote to memory of 3516	3336	regsvr32.exe	68
PID 3516 wrote to memory of 2332	3516	regsvr32.exe	69
PID 3516 wrote to memory of 2332	3516	regsvr32.exe	69
PID 3516 wrote to memory of 2332	3516	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c_2022-01-29__000243.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c_2022-01-29__000243.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3d99629aa662a13fea1981e06dffdb31557c08b96dbad360622705c07a614c8c_2022-01-29__000243.dll",DllRegisterServer
    3⤵
    PID:2332

memory/3516-116-0x0000000000F60000-0x0000000000F87000-memory.dmp

Download