emotet | ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb

Analysis

Target
emotet_exe_e4_ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb_2022-02-09__000612.dll
Size 369KB
Sample220209-aecafagef6
SHA256 ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb
MD5 7a73364619a29a310a451d00753ec904
SHA1 585df7254122900511b431e1b0e45f317f6942eb
SHA512 e5da8ba94ff5c07cf318fdc33f60f0a3e3c0fcb8f8482212ca225090e05cdc2973cda72aac141776500a338f30e2cf3beffa1bae682327926d075c1680ab2d20
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 1412 wrote to memory of 980	1412	regsvr32.exe	27
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28
PID 980 wrote to memory of 588	980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb_2022-02-09__000612.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb_2022-02-09__000612.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ba78b278e869aa0c15633a4b3b2229c9cb142e9ea890dada8d887130fbe4d3eb_2022-02-09__000612.dll",DllRegisterServer
    3⤵
    PID:588

memory/980-55-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/980-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1412-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download