emotet | 0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593

Analysis

Target
emotet_exe_e4_0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593_2022-02-06__000330.dll
Size 997KB
Sample220206-acmcmagbdm
SHA256 0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593
MD5 b6ffdbcbcc4e7daf7f964d3f95a46917
SHA1 4e6dd989e4ba0ed3ac02c585f945f6e0f0ec786a
SHA512 4275dee0b249a7ab663016ef18617cd6c545cf736b3c46a372f26ba387c1ff53414d6275696781b138ae0509af149f9ec956f6f9510b1186698f86065a846eb0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1376 wrote to memory of 1348	1376	regsvr32.exe	27
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28
PID 1348 wrote to memory of 1576	1348	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593_2022-02-06__000330.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593_2022-02-06__000330.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593_2022-02-06__000330.dll",DllRegisterServer
    3⤵
    PID:1576

memory/1348-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1348-57-0x0000000000250000-0x0000000000275000-memory.dmp

Download

memory/1376-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download