emotet | 67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db

Analysis

Target
emotet_exe_e5_67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db_2022-02-10__225501.dll
Size 737KB
Sample220210-2wpqmsahen
SHA256 67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db
MD5 e2c82775b50d9e9442ebe8d8f461b01e
SHA1 5594635bb85c47023bd1ee6846cc74436a692946
SHA512 1d0e8c6f0d996c743a55328b6c34b7cb4fc7327b2bf49157e240c80514ca0fcd89f3bfbc45964ead72d51461f0de1471272150e392a34fcd5522423405f071ad
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 1520 wrote to memory of 960	1520	regsvr32.exe	27
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28
PID 960 wrote to memory of 268	960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db_2022-02-10__225501.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db_2022-02-10__225501.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_67417ae37fd191f0ee23bfad3dbcc21fa5cc80f54768f186802f87fc28fcf5db_2022-02-10__225501.dll",DllRegisterServer
    3⤵
    PID:268

memory/960-55-0x0000000076371000-0x0000000076373000-memory.dmp

Download

memory/960-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1520-54-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download