emotet | 1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f

Analysis

Target
emotet_exe_e5_1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f_2022-02-09__000855.dll
Size 575KB
Sample220209-af3tsaggfk
SHA256 1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f
MD5 09f00f4ad410769aaa58891e7d658d64
SHA1 2e14edcaba49207ecc097e19af713136ed28b131
SHA512 b28b371ad9f0a1a0711c4204b08152a4592e76f3e777d326054bb1fee09381f01ba0611d9baae7b6b03a0941a652d91aa2f50c547ff9a01ab92ef509e057fdcb
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	27
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1656	1648	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f_2022-02-09__000855.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f_2022-02-09__000855.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1bb8b2d613506fa35dbaf95b68d452e5b7ebba23faec9fbfcd831d6604436f0f_2022-02-09__000855.dll",DllRegisterServer
    3⤵
    PID:1656

memory/744-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmp

Download

memory/1648-55-0x0000000075341000-0x0000000075343000-memory.dmp

Download

memory/1648-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download