emotet | e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e

Analysis

Target
emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
Size 520KB
Sample220202-adthbsdchm
SHA256 e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e
MD5 b5ef6b666babfcd26e4fd581fc4eb448
SHA1 290aaae11f715293d3df7308138017c89bf699ad
SHA512 e2260c2222a3920fbf2ccadec14f6fc49c2006176e9ca20db571664087270a95b9ff5b2c5583aa43fc97402868e9af22a0d4ea9e5e87d3d83123f521a77bdef6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 952 wrote to memory of 1752	952	regsvr32.exe	27
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28
PID 1752 wrote to memory of 1636	1752	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll",DllRegisterServer
    3⤵
    PID:1636

memory/952-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download

memory/1752-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/1752-57-0x00000000002A0000-0x00000000002C6000-memory.dmp

Download