emotet | 897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29

Analysis

Target
emotet_exe_e5_897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29_2022-02-07__200107.dll
Size 600KB
Sample220207-yr5phsgef2
SHA256 897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29
MD5 25d20bd4c3019a61ea29b25223c32d70
SHA1 cdef1d28a4a103a1c1bac235b9f9c3477eff47eb
SHA512 1e2356c4a96a3915698af831b5ba5de332b678d15306a32c342477c8ac05d5843150a44388e6ec2516f8142254e890ee2aad744083ac096820a297bd6a58c4eb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28
PID 768 wrote to memory of 984	768	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29_2022-02-07__200107.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29_2022-02-07__200107.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_897f77a4729165fca94a5499bd67f2a76b01e192874e58ae8027f83dd33e0c29_2022-02-07__200107.dll",DllRegisterServer
    3⤵
    PID:984

memory/768-55-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download

memory/768-56-0x0000000000310000-0x0000000000335000-memory.dmp

Download

memory/1764-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download