emotet | 608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef

Analysis

Target
emotet_exe_e5_608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef_2022-02-10__225501.dll
Size 737KB
Sample220210-2wpqmsahel
SHA256 608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef
MD5 2cbb39d24148f3b6d2a34dba01ed3f4b
SHA1 d0d2fd79e82722cbd2b98d2cf45df4c5821e2942
SHA512 e806a748fccd0b76ac07ac83c3b7efa98059eed9d3d56ad5ed3a55bfc5fa4dd5d9d900b292ac92e39e6f311f4f851f401b9708b21765d6fe1dcf5322e2cc172c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1736 wrote to memory of 1312	1736	regsvr32.exe	27
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1752	1312	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef_2022-02-10__225501.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef_2022-02-10__225501.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_608094352332fbecc73e6a62c8385ee9dbf46c317fa16da1c63677a520d617ef_2022-02-10__225501.dll",DllRegisterServer
    3⤵
    PID:1752

memory/1312-55-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/1312-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1736-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download