emotet | 71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b

Analysis

Target
emotet_exe_e4_71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b_2022-02-06__000334.dll
Size 997KB
Sample220206-acmcmagbdp
SHA256 71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b
MD5 20f503fde65de8a57626025ec9782c51
SHA1 da475ce84f8f0a2af7b600588b456706b9fc885b
SHA512 6e69bb6782132536a60a41610abccc69666b88fb21d6fdb3d90d6b93882f58d8c83af52414216d9e2279bb3dbcbb2e81fe690fcdcd4d22946b52af9c8c6c3bac
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1248 wrote to memory of 1696	1248	regsvr32.exe	27
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28
PID 1696 wrote to memory of 1532	1696	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b_2022-02-06__000334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b_2022-02-06__000334.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b_2022-02-06__000334.dll",DllRegisterServer
    3⤵
    PID:1532

memory/1248-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download

memory/1696-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1696-57-0x0000000000210000-0x0000000000235000-memory.dmp

Download