emotet | 13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf

Analysis

Target
emotet_exe_e4_13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf_2022-01-30__000105.dll
Size 538KB
Sample220130-abgezscdc9
SHA256 13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf
MD5 548b453d6fb0f9eff0d90c4eb7772379
SHA1 57c063eb9ac607c7b2894650cddf691f5859292c
SHA512 432895e77bc1bb666ab144ee351677741498d13058e64c18f6965de73dd1d3e2475f63d9afe8ad68a6c2344dbb74c552e6d5f000acdecfb8966efcf639337d6a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3944	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3944	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3944	2760	regsvr32.exe	69
PID 3944 wrote to memory of 1292	3944	regsvr32.exe	70
PID 3944 wrote to memory of 1292	3944	regsvr32.exe	70
PID 3944 wrote to memory of 1292	3944	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf_2022-01-30__000105.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf_2022-01-30__000105.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf_2022-01-30__000105.dll",DllRegisterServer
    3⤵
    PID:1292

memory/3944-116-0x0000000004490000-0x00000000044B5000-memory.dmp

Download