emotet | 43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63

Analysis

Target
emotet_exe_e5_43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63_2022-02-08__081250.dll
Size 758KB
Sample220208-j4eljaeger
SHA256 43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63
MD5 eb87c73533b5ea135d6e591d405b1434
SHA1 eec3632d03e53c884a0f8dd52259d81fa48fc732
SHA512 78f8bb823442a74af0ba434ee244ede5d0e2e5820f9d2c87056a2f92cbfcd7c50412ec8d26a6d3de1e5bba69fe98a2d75cc0eee03d82b4ab30089ccbd7348335
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 740 wrote to memory of 1672	740	regsvr32.exe	27
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28
PID 1672 wrote to memory of 1288	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63_2022-02-08__081250.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63_2022-02-08__081250.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_43ea4eeb90312fd5e92a08b1e11d1bcbd693da52c23cc13f9b0379e0cb7ccf63_2022-02-08__081250.dll",DllRegisterServer
    3⤵
    PID:1288

memory/740-55-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Download

memory/1672-56-0x0000000075321000-0x0000000075323000-memory.dmp

Download

memory/1672-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download