emotet | 5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6

Analysis

Target
emotet_exe_e5_5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6_2022-02-08__190605.dll
Size 360KB
Sample220208-xsnlysdeep
SHA256 5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6
MD5 e9fb193e26f4fa196f904dd6be5d4008
SHA1 24afcc8f36eb7a27aa624fc5e65fcb18720f8b13
SHA512 00dd03a2ef7e90752ec465b0cd69b8c32cff6cb1994f9d1526558c37a4a11e15a4fe24ce6da62890f2abab04fe7a8c6091415dbada00344c5fa553fc75e31c90
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28
PID 1100 wrote to memory of 672	1100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6_2022-02-08__190605.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6_2022-02-08__190605.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_5ac9ecdcac6d1d660278bf84b87ccecea7aadba5508199df757edc9c4856ced6_2022-02-08__190605.dll",DllRegisterServer
    3⤵
    PID:672

memory/1100-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1100-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1876-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download