emotet | 488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47

Analysis

Target
emotet_exe_e4_488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47_2022-02-05__000836.dll
Size 997KB
Sample220205-afgljsfhfp
SHA256 488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47
MD5 e6609c8dd61d69e741ee9556cce4e1e9
SHA1 0fa511c67cbe9043a650047944df07eb6d228183
SHA512 a7d63f2dfe85c13378873f71932b013a1f83f3b676e2cd5e555f961c58244e8b778306f48245fe2e71ee412ecb5e4556b5a2dcae5253408143499736b81a2c53
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 848 wrote to memory of 2044	848	regsvr32.exe	27
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28
PID 2044 wrote to memory of 1588	2044	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47_2022-02-05__000836.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47_2022-02-05__000836.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47_2022-02-05__000836.dll",DllRegisterServer
    3⤵
    PID:1588

memory/848-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download

memory/2044-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/2044-56-0x0000000000450000-0x0000000000475000-memory.dmp

Download