emotet | df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf

Analysis

Target
emotet_exe_e5_df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf_2022-02-10__072730.dll
Size 547KB
Sample220210-jaslasgbf3
SHA256 df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf
MD5 2a9c691825a980002e4024b90f194588
SHA1 db0a8733b6743ebac145337b3b2a62b8e6ab741d
SHA512 10d646b8f02be9a5decc36dc86db4478a2ffbd0f990e3171a075e1d53a1dd36f8f8dd3c64c66b89306e1860e74457e6b9193e79b7917d9280447dfe759dee2dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1156	1532	regsvr32.exe	27
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf_2022-02-10__072730.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf_2022-02-10__072730.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_df68d185dcaf6a9034868c961c79b252c01e1589438df8a83ddae91bd31fccdf_2022-02-10__072730.dll",DllRegisterServer
    3⤵
    PID:588

memory/1156-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/1156-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1532-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download