emotet | 15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d

Analysis

Target
emotet_exe_e5_15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d_2022-01-25__171334.dll
Size 596KB
Sample220125-vr1h1sbfak
SHA256 15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d
MD5 80c4459cd93a3f7854a1aef140a53e9a
SHA1 53848acaa2ade53915dc1056ffe283c5ec28c051
SHA512 541752b6d6a061a06c145671c37cb427af135f441c3b6de66982a6b441ff96033148164f4b41838192793f237df3bf98b5dbb34f8b807646301dcb0402aa5a5c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3980	2648	regsvr32.exe	68
PID 2648 wrote to memory of 3980	2648	regsvr32.exe	68
PID 2648 wrote to memory of 3980	2648	regsvr32.exe	68
PID 3980 wrote to memory of 3776	3980	regsvr32.exe	69
PID 3980 wrote to memory of 3776	3980	regsvr32.exe	69
PID 3980 wrote to memory of 3776	3980	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d_2022-01-25__171334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d_2022-01-25__171334.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_15dffac1128e0c89439d973b80ca7f9ea5fa30c915ec9f2e1f727707969b355d_2022-01-25__171334.dll",DllRegisterServer
    3⤵
    PID:3776

memory/3980-115-0x00000000044A0000-0x00000000044C7000-memory.dmp

Download