emotet | 2cd00e4e64a6013a43e07716fe3a5c91f8fd9ee014fac7a5130a97151b335030

Analysis

Target
emotet_exe_e4_a9eb7700280b3c08e6f0f1610ce08c93b9824fe0696598cc74725709e5fb5164_2022-02-24__011733.dll
Size 664KB
Sample220224-bny18sbga3
SHA256 2cd00e4e64a6013a43e07716fe3a5c91f8fd9ee014fac7a5130a97151b335030
MD5 e38495db8db0dd514bd73b08bf52fc34
SHA1 4aaae39f088730a339966f874d6e150aea1b3c4e
SHA512 b5b2cba44c250051f9ab5c99be622057de7d8d38655bd1e741f07468f884f249760a6f0b054f1f657621270b5447e282c3825645376921470cf2dec777de164b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4640	3248	regsvr32.exe	81
PID 3248 wrote to memory of 4640	3248	regsvr32.exe	81
PID 3248 wrote to memory of 4640	3248	regsvr32.exe	81
PID 4640 wrote to memory of 1440	4640	regsvr32.exe	83
PID 4640 wrote to memory of 1440	4640	regsvr32.exe	83
PID 4640 wrote to memory of 1440	4640	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a9eb7700280b3c08e6f0f1610ce08c93b9824fe0696598cc74725709e5fb5164_2022-02-24__011733.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a9eb7700280b3c08e6f0f1610ce08c93b9824fe0696598cc74725709e5fb5164_2022-02-24__011733.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_a9eb7700280b3c08e6f0f1610ce08c93b9824fe0696598cc74725709e5fb5164_2022-02-24__011733.dll",DllRegisterServer
    3⤵
    PID:1440

memory/4640-130-0x0000000002CC0000-0x0000000002CE5000-memory.dmp

Download