emotet | 7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05

Analysis

Target
emotet_exe_e5_7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05_2022-02-03__201442.dll
Size 982KB
Sample220203-y1srbadca2
SHA256 7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05
MD5 8e4db091dc601f41f2cafb6c1e1188c1
SHA1 92f4d38833826ec4256772738cf5cf5982d44144
SHA512 d0a4c9d014bb669ee8e62e8e73e08568c8ed1ebfed8cd4f0fcd30eeffc278cc3fd4837c62adfa1b4223939857adaa77007acc58955da0f0352466b4dd7cd1775
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1532	1600	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05_2022-02-03__201442.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05_2022-02-03__201442.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7043c2d88401b6d8eecbb6cec22c72e4d79635cb39e2aaf73ecc9f6ae4353c05_2022-02-03__201442.dll",DllRegisterServer
    3⤵
    PID:1532

memory/1600-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1600-55-0x00000000002D0000-0x00000000002F6000-memory.dmp

Download

memory/2016-53-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download