emotet | 55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e

Analysis

Target
emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
Size 575KB
Sample220209-af3tsagfb3
SHA256 55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e
MD5 4cb663afec1670344c72dd8ca72498f0
SHA1 2b66ae419e4c2495cb6b44e86fa89a388f174d22
SHA512 ff82507e948142be6b28914515b213490b8773041501484c19669343a43f8b2c90176c554b6b54108734e1e04dd9f68be4cffa9fdc20f7c8059b4d3f6b834e85
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1848 wrote to memory of 1224	1848	regsvr32.exe	27
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1648	1224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_55675d9b1ff042d44db6d666e0d4f91c770866e93ce811b08425a1bf97e6904e_2022-02-09__000855.dll",DllRegisterServer
    3⤵
    PID:1648

memory/1224-56-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/1224-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1848-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download