emotet | fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988

Analysis

Target
emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
Size 1.4MB
Sample220207-wysmesfcaq
SHA256 fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988
MD5 04b05d08bc1dde8b96d4503d3c67b8ac
SHA1 27650cdee12588443e7fb69b58788e45ef07193c
SHA512 d6406b26df96199161287a3871c174f427f43eb2f14aa183cfb2330419969a4c4a7a86bd7d995258f303ce59f15cd28e94c3089186ea3051f239d041aed641f3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 1108 wrote to memory of 2024	1108	regsvr32.exe	27
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28
PID 2024 wrote to memory of 2012	2024	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll",DllRegisterServer
    3⤵
    PID:2012

memory/1108-55-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download

memory/2024-56-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/2024-57-0x0000000010000000-0x0000000010028000-memory.dmp

Download