emotet | 966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4

Analysis

Target
emotet_exe_e5_966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4_2022-02-08__221929.dll
Size 575KB
Sample220208-1846esffh2
SHA256 966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4
MD5 48defb23dde605126606a7fcfde0cad8
SHA1 61ce2491f21ab22adc6f1f70b7cb9e0ef0ea3677
SHA512 f49417e9e206fa8a1271ed71b690a7b703e2512552627d148b061914385d3444ae81989bbccae14a743eb03f8c1d6ebe6bf8ad8e14c5972536c4e4fe0c91be57
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 968 wrote to memory of 1668	968	regsvr32.exe	27
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28
PID 1668 wrote to memory of 828	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4_2022-02-08__221929.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4_2022-02-08__221929.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_966831f686e82dd4f39f21d01a6bd8a5bd9e2c32d6a52b4ec0da39ab56277ff4_2022-02-08__221929.dll",DllRegisterServer
    3⤵
    PID:828

memory/968-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1668-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1668-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download