emotet | 2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed

Analysis

Target
emotet_exe_e5_2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed_2022-02-09__000853.dll
Size 575KB
Sample220209-af3tsaggfm
SHA256 2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed
MD5 ff559d048f1252e020a00b21c302aac0
SHA1 f6e98d40b1f399df2eb30da399a4f5d19f8fb03a
SHA512 b22a97cd3f5641303374e5312474e39f0c216866002e203115cfd545c8baf54682f43c2792ccc2206746eca7c96e65e4e1b62804aa87c6a1cd4a96c2c1ceb198
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 1564 wrote to memory of 804	1564	regsvr32.exe	27
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28
PID 804 wrote to memory of 592	804	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed_2022-02-09__000853.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed_2022-02-09__000853.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e1579477e74ba6dfcd7c0677779258e8dfc4a0c04985e0f8e4b7c8d4e4e5eed_2022-02-09__000853.dll",DllRegisterServer
    3⤵
    PID:592

memory/804-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/804-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1564-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download