emotet | a652067649bb2549f2a4e205fd8350c328f113791af7980a8cd7f0a1c4d8758b

Analysis

Target
emotet_exe_e4_42cebb3268e937c8d03e6f6d37360bec7437e5298bd4bcb3af38d5a221fff130_2022-02-04__024720.dll
Size 977KB
Sample220204-dafnvaeea7
SHA256 a652067649bb2549f2a4e205fd8350c328f113791af7980a8cd7f0a1c4d8758b
MD5 913d70ad402eec65f2d9d5824154e020
SHA1 35df78507189124a2fb49fe1e4e2c0231748d38d
SHA512 bcd89c14abc91d3cc77b17d28bb00be712a95b498551015a4e40afc03b77446d6f493777c7ce4c10fae73daf54588b40f7f58ea8a28f2f5e9247b4ec8ac69064
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_42cebb3268e937c8d03e6f6d37360bec7437e5298bd4bcb3af38d5a221fff130_2022-02-04__024720.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_42cebb3268e937c8d03e6f6d37360bec7437e5298bd4bcb3af38d5a221fff130_2022-02-04__024720.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_42cebb3268e937c8d03e6f6d37360bec7437e5298bd4bcb3af38d5a221fff130_2022-02-04__024720.dll",DllRegisterServer
    3⤵
    PID:1576

memory/1348-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1348-55-0x0000000000230000-0x0000000000255000-memory.dmp

Download

memory/1376-53-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download