emotet | f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060

Analysis

Target
emotet_exe_e5_f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060_2022-02-10__225503.dll
Size 737KB
Sample220210-2wpqmshdc6
SHA256 f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060
MD5 9c82bbbd786eda51bc5e730e7ce85d02
SHA1 949d9074efd1a7a0c4d3a323b19c37801d1f772d
SHA512 2507c6a1703771f6e1931261d137be810893a5d3c1abfd62e6c4d85b00794ed3bf5651160a92ee0155e9903f57bcea83f1d3199ac9234fb6d1a64bc4810fff13
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 812 wrote to memory of 948	812	regsvr32.exe	27
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28
PID 948 wrote to memory of 320	948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060_2022-02-10__225503.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060_2022-02-10__225503.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f36cd4d29ea88e95881201aeeb0117fd5ac224272c3bf5a2f6448b3a79351060_2022-02-10__225503.dll",DllRegisterServer
    3⤵
    PID:320

memory/812-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Download

memory/948-55-0x0000000076C91000-0x0000000076C93000-memory.dmp

Download

memory/948-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download