emotet | 8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697

Analysis

Target
emotet_exe_e5_8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697_2022-02-07__135752.dll
Size 216KB
Sample220207-q9vm9scfdp
SHA256 8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697
MD5 0399e15fe5e69781e97fd6b8667b1162
SHA1 3091a84ba7aa153c0dbec584be4fe8dde5096747
SHA512 dcc111e332d72e4fcd2eeb292d9e017f2ebae547d0d114bebd579f7648f5c436232f89203f077924bd3eb65c268ffa90144fc6aa332e317ab086099a0735433e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1344	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697_2022-02-07__135752.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697_2022-02-07__135752.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8b5ee453ccfea68e6d05bc1165058a73fd43125b2801a48fe4ae90aa04592697_2022-02-07__135752.dll",DllRegisterServer
    3⤵
    PID:1344

memory/1492-56-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/1492-57-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/1992-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Download