emotet | d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8

Analysis

Target
emotet_exe_e5_d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8_2022-01-31__143404.dll
Size 542KB
Sample220131-rx7mqshdal
SHA256 d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8
MD5 0c9de10c6618fc8a68cdad276654e958
SHA1 1189df0ae53e672ef9a2d630e0efd28013ac165c
SHA512 a7ff70b22e241e137829770a25155d858f11cd1c1c159f4200aeac8aca376bdad14088b8242b8c134d52325a962f0a76cd79df2784a806a6deb5b396439a5d84
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1568 wrote to memory of 1924	1568	regsvr32.exe	27
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28
PID 1924 wrote to memory of 768	1924	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8_2022-01-31__143404.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8_2022-01-31__143404.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d11ed53346c8462194792ad014e8f980cf572133bee6b1962738ddc24dd2dde8_2022-01-31__143404.dll",DllRegisterServer
    3⤵
    PID:768

memory/1568-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1924-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1924-56-0x0000000000220000-0x0000000000247000-memory.dmp

Download