emotet | dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042

Analysis

Target
emotet_exe_e4_dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042_2022-01-31__163815.dll
Size 412KB
Sample220131-t5zyzaaeb7
SHA256 dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042
MD5 32109653bad70eea4749dcc2a8352a3f
SHA1 86de65c9dbb8c5438502594c485decebd135a388
SHA512 cb82fa342f1bda7caac689abd674211cf01e79aeacc0b7481321757be06c966368afcaa02373f0812d984b4ace0b1d3d39c590193f69d582467dabe3d7f8dd0c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1328	1308	regsvr32.exe	27
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28
PID 1328 wrote to memory of 588	1328	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042_2022-01-31__163815.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042_2022-01-31__163815.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_dd6df89ccef4c4dde1cb42e573ca13d0900a570f55cdea5814cd7a5d32b95042_2022-01-31__163815.dll",DllRegisterServer
    3⤵
    PID:588

memory/1308-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Download

memory/1328-55-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/1328-57-0x0000000000260000-0x0000000000285000-memory.dmp

Download