emotet | 6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab

Analysis

Target
emotet_exe_e5_6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab_2022-02-03__000142.dll
Size 979KB
Sample220203-ablppscdfk
SHA256 6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab
MD5 0bf7afbd019c61e04bc416f4ba5bc5a4
SHA1 e44fb8cc38a00b9b0b6cf212823c3535783c6edf
SHA512 ce34b96521346b6ee06d37782eb36810a69f4eebdf06e57e219cd0ff645a88a5e0406b834708535bf12b720b5b63fe8d5bd3969a0f776285059e9419e24fb389
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1208 wrote to memory of 1040	1208	regsvr32.exe	27
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1112	1040	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab_2022-02-03__000142.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab_2022-02-03__000142.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bcd19be5bd000589da78c6ce2e9cc6ed6852e1c6bdc2313a74b5a214314a2ab_2022-02-03__000142.dll",DllRegisterServer
    3⤵
    PID:1112

memory/1040-54-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/1040-55-0x00000000001A0000-0x00000000001C6000-memory.dmp

Download

memory/1208-53-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download