emotet | aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2

Analysis

Target
emotet_exe_e4_aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2_2022-02-07__181953.dll
Size 1.4MB
Sample220207-wysmesfch7
SHA256 aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2
MD5 24341ce0795462fcf4ae0be7002adf6a
SHA1 b50f76cd83a483a72d49f1155db8f6401054b648
SHA512 117d1dbdeb788720fbf1656172504a9835049aae26777bef5e989f5efc1c26543f3c6f7d0abf70a2d8419463545603993b00dfb243d98a1bf21436c9b82bd2e4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 2000 wrote to memory of 1120	2000	regsvr32.exe	27
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28
PID 1120 wrote to memory of 1544	1120	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2_2022-02-07__181953.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2_2022-02-07__181953.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_aa74ae5cd1f73a3401dccf3ba8caa8ada7d3a7b6a7009b2e0a3750bf7c5d71b2_2022-02-07__181953.dll",DllRegisterServer
    3⤵
    PID:1544

memory/1120-56-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/1120-58-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/2000-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Download