emotet | 9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9

Analysis

Target
emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
Size 988KB
Sample220203-abldyaceb4
SHA256 9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9
MD5 ca03638fb30d38e8452c0a2bb2add0f7
SHA1 bbddb52d9b9627594395819aea663361f4488323
SHA512 47a2d095793ca68248bffceba641c34c0ca542885502fd0600a566ed616ad0eb84344ef38d7268ca4393594363afaa6f54f7df2e7528dbd0f85919fd55e92ed0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2028 wrote to memory of 2024	2028	regsvr32.exe	27
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28
PID 2024 wrote to memory of 1336	2024	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll",DllRegisterServer
    3⤵
    PID:1336

memory/2024-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/2024-56-0x00000000003C0000-0x00000000003E5000-memory.dmp

Download

memory/2028-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download