emotet | 58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e

Analysis

Target
emotet_exe_e4_58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e_2022-02-04__000907.dll
Size 977KB
Sample220204-af279aeebk
SHA256 58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e
MD5 e370bc4125d5ee182e081bc24c377f8c
SHA1 59c30ff83cd5fa3f09f2960e3a38c34f937071ad
SHA512 872d66bca070c656f8d56bf8b4234e1bc09596d328c0eec5b6f9520b245792b37de977d6f716072282cf7642fb8c8c2d800c394495c281d4a03032b0abf81f0c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1264	1128	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e_2022-02-04__000907.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e_2022-02-04__000907.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_58ec1c1d23a0ab4041d792efeec8eb3e26eb7fcda7a1c63491aa2aa84c8cb72e_2022-02-04__000907.dll",DllRegisterServer
    3⤵
    PID:1264

memory/1128-54-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1128-55-0x00000000001F0000-0x0000000000215000-memory.dmp

Download

memory/1296-53-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download