emotet | d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5

Analysis

Target
emotet_exe_e5_d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5_2022-02-10__072731.dll
Size 547KB
Sample220210-jaslasgdbm
SHA256 d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5
MD5 71dd0eccd06756c7de25f28ead9cdf25
SHA1 d729c30c844cd0ef5d870940c63ba4c3ab96ba61
SHA512 8bb2d07b9737423576edc1b6e2979470499b004d0fe28a782da2055a3bf3e5da4cc81e33722700440ce47f83a802329e064f4f0faed9546915db7854efc254ea
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1712 wrote to memory of 1892	1712	regsvr32.exe	27
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28
PID 1892 wrote to memory of 1352	1892	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5_2022-02-10__072731.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5_2022-02-10__072731.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d8d3fc16d501d73477ec197c5872f416070d1cb397ea94e9a5c2bd33530b2fa5_2022-02-10__072731.dll",DllRegisterServer
    3⤵
    PID:1352

memory/1712-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download

memory/1892-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1892-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download