emotet | cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb

Analysis

Target
emotet_exe_e4_cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb_2022-01-29__101348.dll
Size 538KB
Sample220129-l9nshaach5
SHA256 cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb
MD5 a3131a4eadbc1741aa887256ffeeba2b
SHA1 c7d2038bb5db80d14bb9bd3df91e0f2613a3bca0
SHA512 61cefa0615801fdb598b3da8b09ca69a2b77b3337e3048ad17e04854c19741281b94634a95c446a603f2cc40985bf6bb7ff5459aeecab4262957f24fae39bd29
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 2092	748	regsvr32.exe	69
PID 748 wrote to memory of 2092	748	regsvr32.exe	69
PID 748 wrote to memory of 2092	748	regsvr32.exe	69
PID 2092 wrote to memory of 3148	2092	regsvr32.exe	70
PID 2092 wrote to memory of 3148	2092	regsvr32.exe	70
PID 2092 wrote to memory of 3148	2092	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb_2022-01-29__101348.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb_2022-01-29__101348.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_cca39c2b9ccc10968dcf84f7cc2b0d7367e29be78c7b50ee061634af25c47eeb_2022-01-29__101348.dll",DllRegisterServer
    3⤵
    PID:3148

memory/2092-115-0x0000000000860000-0x0000000000885000-memory.dmp

Download