emotet | 8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576

Analysis

Target
emotet_exe_e4_8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576_2022-02-03__161557.dll
Size 633KB
Sample220203-tree4sbfa6
SHA256 8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576
MD5 11f1f2fa26b71689ecd68b315648ff09
SHA1 d199accbbbc34823b0994ddecf0fd44b14b95dd3
SHA512 3326699bb7067fcdc13b981c9ef645492f1cb4f2e7587b6cf26e606b0d2df90e1e541208dc5e11f73954288fcae8de4e80a43bf74686a8b9d03affa4092e96f2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 2024 wrote to memory of 1368	2024	regsvr32.exe	27
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30
PID 1368 wrote to memory of 584	1368	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576_2022-02-03__161557.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576_2022-02-03__161557.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8d3c00d15dc1880a26dd0cf1c4eaa88bc24df8ac89fd305fdd89c927c17d0576_2022-02-03__161557.dll",DllRegisterServer
    3⤵
    PID:584

memory/1368-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1368-55-0x0000000000780000-0x00000000007A6000-memory.dmp

Download

memory/2024-53-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download