emotet | e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e

Analysis

Target
emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
Size 520KB
Sample220202-adthbsdchm
SHA256 e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e
MD5 b5ef6b666babfcd26e4fd581fc4eb448
SHA1 290aaae11f715293d3df7308138017c89bf699ad
SHA512 e2260c2222a3920fbf2ccadec14f6fc49c2006176e9ca20db571664087270a95b9ff5b2c5583aa43fc97402868e9af22a0d4ea9e5e87d3d83123f521a77bdef6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2168	2476	regsvr32.exe	56
PID 2476 wrote to memory of 2168	2476	regsvr32.exe	56
PID 2476 wrote to memory of 2168	2476	regsvr32.exe	56
PID 2168 wrote to memory of 1468	2168	regsvr32.exe	60
PID 2168 wrote to memory of 1468	2168	regsvr32.exe	60
PID 2168 wrote to memory of 1468	2168	regsvr32.exe	60

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e7068883e401d8b0e99d9f4ac4653c588039480eb735965e5baeaaab53740c3e_2022-02-02__000515.dll",DllRegisterServer
    3⤵
    PID:1468

memory/2168-131-0x00000000045E0000-0x0000000004606000-memory.dmp

Download