emotet | 426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4

Analysis

Target
emotet_exe_e5_426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4_2022-02-10__164324.dll
Size 465KB
Sample220210-t8talaaedp
SHA256 426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4
MD5 d8f5515cc7ee5bdf0dbb65e50454bc51
SHA1 cff10c773e02f70a210dfe90be6b1642437f7cf3
SHA512 12d363879eb7a18990606e6a9e69e523e18b9388155102f81ff225c88e90b9f4da077375575eca57498f12a5b5dcc6da37a0f3a327620a936ef0d17102647ab0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 600 wrote to memory of 1592	600	regsvr32.exe	27
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4_2022-02-10__164324.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4_2022-02-10__164324.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_426c326518383424a5cf0cc7aaa9eb6e8cbbf14fd238d3a5a50e6c22f5e4a8a4_2022-02-10__164324.dll",DllRegisterServer
    3⤵
    PID:1028

memory/600-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Download

memory/1592-55-0x0000000076151000-0x0000000076153000-memory.dmp

Download

memory/1592-57-0x00000000001A0000-0x00000000001C5000-memory.dmp

Download