emotet | c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7

Analysis

Target
emotet_exe_e5_c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7_2022-02-02__000518.dll
Size 520KB
Sample220202-adthbsddaj
SHA256 c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7
MD5 6a76bc2fd45fb590dde1d1b636bd21fd
SHA1 6d162d473dd52b5472e9265b19578585f4b363c9
SHA512 d1aa02fdda926e2989986eb1ba8a757b28753562c106195084a79f778ac5e6979754620b933213be3742ec5f7e86959283dffa65f34ea8ad2edd9ae9b42f2019
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1796	1636	regsvr32.exe	27
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28
PID 1796 wrote to memory of 524	1796	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7_2022-02-02__000518.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7_2022-02-02__000518.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c17dfc7432faf03f04e16f3f672ad7d2f881dca383aa3e8d972ff9a21ecb65e7_2022-02-02__000518.dll",DllRegisterServer
    3⤵
    PID:524

memory/1636-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1796-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1796-56-0x00000000004B0000-0x00000000004D6000-memory.dmp

Download