emotet | 268f5e4b066f55e8c8f920b68ac1092fef1bac7e80822991043acc7f2d5fd2de

Analysis

Target
emotet_exe_e5_8f5571f31b12e14808e87aea138ab3d5acd55db988d43f64427860713c54cfbf_2022-01-29__060729.dll
Size 784KB
Sample220129-gvxpmsedbn
SHA256 268f5e4b066f55e8c8f920b68ac1092fef1bac7e80822991043acc7f2d5fd2de
MD5 5ca4822d29b28f8335d1208ea03aa92b
SHA1 bd91a6be5d46e9c5e06e8446fa419d2a0f6cde2d
SHA512 268133d714210b631d1656c7f4ade5a90f9d0d307f435370182693c4bb414c84317adbc3996ca7a3c265355827ff6078a183a1aa0a0ce12e111532d30b9d6201
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3328	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3328	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3328	2772	regsvr32.exe	69
PID 3328 wrote to memory of 1288	3328	regsvr32.exe	70
PID 3328 wrote to memory of 1288	3328	regsvr32.exe	70
PID 3328 wrote to memory of 1288	3328	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8f5571f31b12e14808e87aea138ab3d5acd55db988d43f64427860713c54cfbf_2022-01-29__060729.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8f5571f31b12e14808e87aea138ab3d5acd55db988d43f64427860713c54cfbf_2022-01-29__060729.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8f5571f31b12e14808e87aea138ab3d5acd55db988d43f64427860713c54cfbf_2022-01-29__060729.dll",DllRegisterServer
    3⤵
    PID:1288

memory/3328-116-0x0000000004F50000-0x0000000004F77000-memory.dmp

Download