emotet | e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20

Analysis

Target
emotet_exe_e5_e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20_2022-01-30__000035.dll
Size 546KB
Sample220130-aaw42scdb5
SHA256 e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20
MD5 45aff94af017892a777a19dcaa2f55a3
SHA1 a2d97ba1852d18eaf36dc29c65312b717c198a79
SHA512 76afa12c31f9699f0cd873834f18ec560115ede5a8d401bfbc5011e2272c8a68e6281c932d6e15fc01b235f0262e80c579ad0b034f2e8a9079b2776cb395260b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3608	3328	regsvr32.exe	68
PID 3328 wrote to memory of 3608	3328	regsvr32.exe	68
PID 3328 wrote to memory of 3608	3328	regsvr32.exe	68
PID 3608 wrote to memory of 1876	3608	regsvr32.exe	69
PID 3608 wrote to memory of 1876	3608	regsvr32.exe	69
PID 3608 wrote to memory of 1876	3608	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20_2022-01-30__000035.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20_2022-01-30__000035.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e2d6fcae0f0954fb79b905760507b67320c9a6c4f2f78c011dc2e10d0972eb20_2022-01-30__000035.dll",DllRegisterServer
    3⤵
    PID:1876

memory/3608-119-0x0000000004B10000-0x0000000004B37000-memory.dmp

Download