emotet | 9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167

Analysis

Target
emotet_exe_e4_9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167_2022-02-04__000907.dll
Size 977KB
Sample220204-af279aebc2
SHA256 9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167
MD5 a2a1667fd3f98d1b46d6ecd1f5e0aee6
SHA1 11e407b34999886b0b521486a2d3f2a8513f650c
SHA512 50a1d72a1f625db94ab675f6d62f960dabad90dc1f036c54849e49263ad301697bce6210332f40557b5336efd88f0467773ab29c1e2b4340434ab6a35a1eca63
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1988	1992	regsvr32.exe	27
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28
PID 1988 wrote to memory of 1276	1988	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167_2022-02-04__000907.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167_2022-02-04__000907.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9776d5dc6587ce4fa4b84e58cd8dcf6b8ddce40ccb17ff647bc0231ea318b167_2022-02-04__000907.dll",DllRegisterServer
    3⤵
    PID:1276

memory/1988-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1988-56-0x00000000001D0000-0x00000000001F5000-memory.dmp

Download

memory/1992-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download