emotet | 1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a

Analysis

Target
emotet_exe_e4_1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a_2022-02-03__000121.dll
Size 988KB
Sample220203-abldyaceb8
SHA256 1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a
MD5 10ad4999d1c893a6e91a3f4602215acc
SHA1 7bd61467694b95490cad061d2ebca58e36ae6112
SHA512 9e09ebd14fbde3d0acd5ae9576cfb8c4de73659228099721bde308249e1df6b652524eef15b51669dc2b8e351ba612dbb7309fe6340ebc814f291734afafbe77
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1120	2008	regsvr32.exe	27
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1520	1120	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a_2022-02-03__000121.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a_2022-02-03__000121.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a_2022-02-03__000121.dll",DllRegisterServer
    3⤵
    PID:1520

memory/1120-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Download

memory/1120-55-0x0000000000160000-0x0000000000185000-memory.dmp

Download

memory/2008-53-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download