emotet | 48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef

Analysis

Target
emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
Size 684KB
Sample220202-ab61msdcep
SHA256 48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef
MD5 e7ee2dcb74b40d7c1d212e7513d2afcc
SHA1 dbf7c045c2d33e64dac1524916d138e075b82d48
SHA512 769724cdfc22474bfbf7743c6844d52e1ba8cdc277bf5569477407961e2f111107a07f1ff03f71e37dc69bfdc491154669fd77249024563f8ebdeee9d122cd2c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3380	3048	regsvr32.exe	53
PID 3048 wrote to memory of 3380	3048	regsvr32.exe	53
PID 3048 wrote to memory of 3380	3048	regsvr32.exe	53
PID 3380 wrote to memory of 1040	3380	regsvr32.exe	57
PID 3380 wrote to memory of 1040	3380	regsvr32.exe	57
PID 3380 wrote to memory of 1040	3380	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll",DllRegisterServer
    3⤵
    PID:1040

memory/3380-131-0x00000000048F0000-0x0000000004915000-memory.dmp

Download