emotet | f2d86d22cd8dc9883c01e3c96e710bc0452fc8735457bf5185765afe742f05db

Analysis

Target
emotet_exe_e4_af10abe637638cd15381a53dc26039bd631e74e5e7c85a75564461295d989c92_2022-03-23__004313.dll
Size 997KB
Sample220323-a3jdnahbdm
SHA256 f2d86d22cd8dc9883c01e3c96e710bc0452fc8735457bf5185765afe742f05db
MD5 870ee049fc52d9343f169fae3a55a6e6
SHA1 5b033a20726cd9d61a7f9f64c6fef6ed744e118e
SHA512 27f5f18620ba274f849401b4f84e5cdd26ec072ddeb665f9d87b5336372eb50c84009a31f7a313d3f67f7ac947d8b992b4246941c57d21e43cfb74fe72b941ed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 3088	1716	regsvr32.exe	83
PID 1716 wrote to memory of 3088	1716	regsvr32.exe	83
PID 1716 wrote to memory of 3088	1716	regsvr32.exe	83
PID 3088 wrote to memory of 2220	3088	regsvr32.exe	84
PID 3088 wrote to memory of 2220	3088	regsvr32.exe	84
PID 3088 wrote to memory of 2220	3088	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af10abe637638cd15381a53dc26039bd631e74e5e7c85a75564461295d989c92_2022-03-23__004313.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af10abe637638cd15381a53dc26039bd631e74e5e7c85a75564461295d989c92_2022-03-23__004313.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_af10abe637638cd15381a53dc26039bd631e74e5e7c85a75564461295d989c92_2022-03-23__004313.dll",DllRegisterServer
    3⤵
    PID:2220

memory/3088-135-0x0000000000C70000-0x0000000000C96000-memory.dmp

Download