emotet | 2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47

Analysis

Target
emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
Size 988KB
Sample220202-vpwr2sdcan
SHA256 2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47
MD5 a90068f5e03507be372e0a7485f6c381
SHA1 d0de2bfeadef16e863f6487e7df2695fd626fc75
SHA512 664c8521b3dcdaff049a2b3db25e05d7253b9c0b393b4ebbe91a0a623b2c6d7c074e1eff5b3a1006b63e22cb668335c8c542d22e1807ee017521e507bdbd329a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1552	1600	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll",DllRegisterServer
    3⤵
    PID:1552

memory/1600-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1600-55-0x0000000000350000-0x0000000000375000-memory.dmp

Download

memory/2016-53-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download