emotet | 60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598

Analysis

Target
emotet_exe_e5_60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598_2022-02-09__000853.dll
Size 575KB
Sample220209-af3tsaggfl
SHA256 60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598
MD5 dce83b2f065d6e03a3ce83abd9536a62
SHA1 39eee4fbb421618615b3417037285b280d408fa7
SHA512 d0cf5e4837b88fb0b6e0a76872951512d38e04256253813174d3a3dc6f7f7e2c9f30c606b343ba19690bd294adfd379acdad9d5ae2f0080a6f8daea78d87644c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1520	1752	regsvr32.exe	27
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28
PID 1520 wrote to memory of 1444	1520	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598_2022-02-09__000853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598_2022-02-09__000853.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_60ef798d885a4224adf719122b50a0ad9f9305565b21a2023b5153b1a0de1598_2022-02-09__000853.dll",DllRegisterServer
    3⤵
    PID:1444

memory/1520-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/1520-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1752-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download