emotet | 00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6

Analysis

Target
emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
Size 629KB
Sample220128-fr3aaafhbr
SHA256 00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6
MD5 8c85d8f10f449c46fb40d8e2072d769a
SHA1 d3c5d40893bc0fa56dede8b27cf275315d508420
SHA512 c095eb8865ada81e0cca8bd8ee5eade507ad4b80940129e3111cd458024a7489f003d116aef22ede32304c9f1e279a84111f1d67e7ea654adb82e7c10b2bb4b8
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 848	1364	regsvr32.exe	68
PID 1364 wrote to memory of 848	1364	regsvr32.exe	68
PID 1364 wrote to memory of 848	1364	regsvr32.exe	68
PID 848 wrote to memory of 3548	848	regsvr32.exe	69
PID 848 wrote to memory of 3548	848	regsvr32.exe	69
PID 848 wrote to memory of 3548	848	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00815b0224100e151c50cdc2ebeafa2c3a0d28e7f498fb286760670b374c42e6_2022-01-28__050651.dll",DllRegisterServer
    3⤵
    PID:3548

memory/848-118-0x00000000047E1000-0x0000000004802000-memory.dmp

Download