emotet | bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59

Analysis

Target
emotet_exe_e5_bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59_2022-02-03__000141.dll
Size 979KB
Sample220203-ablppscec3
SHA256 bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59
MD5 be6a2d03e33f0dd15b749a77881e283b
SHA1 50618eb427dc009489bf260a6bd0a5d66616b119
SHA512 8a60978ca6cd8148fc187a468227bd1a8cad5bae8799496f19a3610b8876254c3bd5fa3c3eac1a5ea1170e8c2296ccd75788b1c09e1cd13792ff5eaa6bf61c18
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1636	2008	regsvr32.exe	27
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1676	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59_2022-02-03__000141.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59_2022-02-03__000141.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bfce07dbe4c2e5db958fca611794b65c776c114197b5964485e73357eb9f4e59_2022-02-03__000141.dll",DllRegisterServer
    3⤵
    PID:1676

memory/1636-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1636-55-0x0000000000190000-0x00000000001B6000-memory.dmp

Download

memory/2008-53-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download