emotet | 4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217

Analysis

Target
emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
Size 1.4MB
Sample220207-wysmesfch8
SHA256 4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217
MD5 c7cad7e76a58e122197829bc6f473808
SHA1 9bfd43530eaa18d4fe9fa0557cf7db478cbdeaa4
SHA512 daa1928f22ae42ab3fc9f7c59e2a8e7e937a7ed384bf7f09e7170bd2e5fdea3da0ec0acfd54c22c7fc27ecfbfbb51c4358d2b71d7e8745d963f89f96d6997701
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 628 wrote to memory of 1588	628	regsvr32.exe	27
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1624	1588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll",DllRegisterServer
    3⤵
    PID:1624

memory/628-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download

memory/1588-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/1588-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download