emotet | de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2

Analysis

Target
emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
Size 369KB
Sample220209-aecafageg2
SHA256 de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2
MD5 8c228e333bf13944dc5373e56066cff3
SHA1 71bb0373f2b3d7591318f736eb85339be4a8feea
SHA512 ae588226077afdcae01d57462c5ba6c6dd5c6f8dc845f748a98ea6b6ec38fa942cf7a3605dbec8ae4602a2fb4103cd2d5f97fefa72e142aece0ab3aa88ea766e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1468 wrote to memory of 1288	1468	regsvr32.exe	27
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28
PID 1288 wrote to memory of 1248	1288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_de385beac6b7cbb295c87423a1254411262fc9a6385f7debf5bad6140686caa2_2022-02-09__000611.dll",DllRegisterServer
    3⤵
    PID:1248

memory/1288-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1288-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1468-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download