emotet | 6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295

Analysis

Target
emotet_exe_e4_6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295_2022-02-09__000612.dll
Size 369KB
Sample220209-aecafagef9
SHA256 6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295
MD5 25f53cdc61cdd5e004027ca70a87e824
SHA1 6e484775231afbe99bacd04cc46ff783a7addf0c
SHA512 233aedb65e4d716dc695d453d80f93554bc673de1a37d4a1c76a60461a753f244a472d22514ce86d773bf492d8f58952dda1fd49d0423324f79340d2e458fde5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1668	1752	regsvr32.exe	27
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1456	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295_2022-02-09__000612.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295_2022-02-09__000612.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6079fdfa2a5fbe1d27842e96a86f5ab40d8b3dd85383f1290369763fcc474295_2022-02-09__000612.dll",DllRegisterServer
    3⤵
    PID:1456

memory/1668-56-0x0000000076921000-0x0000000076923000-memory.dmp

Download

memory/1668-57-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1752-55-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download