emotet | b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df

Analysis

Target
emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
Size 575KB
Sample220209-af3tsagfb2
SHA256 b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df
MD5 3ee6b328fa65c5589b564d596138a4ed
SHA1 65c4c5383109905a54fa2d6b5ba9876c0721604b
SHA512 02f44fc56b4375d71f13678f2cd2946d3d86924fe7d854df5b3e51e1313f5a78ef6c23876c39df49e7c9925c52bf8bebefdc19fe89edbe2afc04bf75fcc6dd70
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1204 wrote to memory of 1600	1204	regsvr32.exe	27
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28
PID 1600 wrote to memory of 268	1600	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b9050ba74c3223dc34da20f62ec159ecd72d0c71674a8bcb3aba0e27ad2df4df_2022-02-09__000853.dll",DllRegisterServer
    3⤵
    PID:268

memory/1204-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1600-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1600-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download