emotet | 006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60

Analysis

Target
emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
Size 538KB
Sample220130-abgezscdc7
SHA256 006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60
MD5 3b884af02c4eab3fea2760d227e87f3b
SHA1 9a7aacf9bfaaaf6ba332b87ab67e12b5a312ee74
SHA512 aecb838c8d3415a90ba25ef27fc4df6cde27a068ec5727fe032a6b93cf193cfb5c873babf1a23965961d6b86bf8d143981c43394ab09fedf00e5797b5533fd5d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 920	3808	regsvr32.exe	69
PID 3808 wrote to memory of 920	3808	regsvr32.exe	69
PID 3808 wrote to memory of 920	3808	regsvr32.exe	69
PID 920 wrote to memory of 2336	920	regsvr32.exe	70
PID 920 wrote to memory of 2336	920	regsvr32.exe	70
PID 920 wrote to memory of 2336	920	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll",DllRegisterServer
    3⤵
    PID:2336

memory/920-116-0x0000000004CB0000-0x0000000004CD5000-memory.dmp

Download