emotet | 00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6

Analysis

Target
emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
Size 629KB
Sample220128-fr3aaafhbr
SHA256 00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6
MD5 8c85d8f10f449c46fb40d8e2072d769a
SHA1 d3c5d40893bc0fa56dede8b27cf275315d508420
SHA512 c095eb8865ada81e0cca8bd8ee5eade507ad4b80940129e3111cd458024a7489f003d116aef22ede32304c9f1e279a84111f1d67e7ea654adb82e7c10b2bb4b8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28
PID 1480 wrote to memory of 576	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll",DllRegisterServer
    3⤵
    PID:576

memory/780-55-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1480-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

Download

memory/1480-57-0x00000000001D0000-0x00000000001F5000-memory.dmp

Download