emotet | 91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8

Analysis

Target
emotet_exe_e5_91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8_2022-02-10__072729.dll
Size 547KB
Sample220210-jaslasgbf4
SHA256 91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8
MD5 ab9d70719a27b5a393e34349dad61cbe
SHA1 611b2e9325b2a465d5e6dcb74d7e56434e8a629e
SHA512 f5ff4d88a4fb7c080aa430d37c0e264b14252bce384108b911fcf239fce757e8d14ba164dcdba59121fe0eff295d67669ce5449422ba2465c2a886c33ff45d7f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28
PID 304 wrote to memory of 800	304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8_2022-02-10__072729.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8_2022-02-10__072729.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:304
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_91759065a41f246a64a009bb4f0d4c42e3ce878e36af455479af7e53d0e920a8_2022-02-10__072729.dll",DllRegisterServer
    3⤵
    PID:800

memory/304-56-0x00000000762C1000-0x00000000762C3000-memory.dmp

Download

memory/304-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1768-55-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Download