emotet | 115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab

Analysis

Target
emotet_exe_e4_115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab_2022-02-03__121137.dll
Size 972KB
Sample220203-pc7e5aghgl
SHA256 115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab
MD5 4147181a20b9892db2564e172f75432d
SHA1 59cdf915b228105cdf612c7634c032df0b3479b5
SHA512 74e66e610e5cad6c5b46e66c9c2d7d3e12af3e2b8f9877f7fd806b2a94eb809ce2ab315d3436dce555c789b83522b4d998b72577a48f24d026b5f8816343a695
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1336	1992	regsvr32.exe	27
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1276	1336	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab_2022-02-03__121137.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab_2022-02-03__121137.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab_2022-02-03__121137.dll",DllRegisterServer
    3⤵
    PID:1276

memory/1336-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1336-56-0x00000000001F0000-0x0000000000215000-memory.dmp

Download

memory/1992-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download