emotet | 3df0db3be205f365f3dedbeb2d021c6a4cb67e53e7558190b9ae65ae9956ba6f

Analysis

Target
5e49f42cdaa75ac2bf3f6317e9ce91a1.dll
Size 1.3MB
Sample211207-ywlgfacfhm
SHA256 3df0db3be205f365f3dedbeb2d021c6a4cb67e53e7558190b9ae65ae9956ba6f
MD5 5e49f42cdaa75ac2bf3f6317e9ce91a1
SHA1 cb2366a52fbaacbc95584e80af0944d9db8088f3
SHA512 e4cc20357e634448601b4a516b1fcbe6d169aa91f6075f49ff5f62c3da4d43e5764f127e7f7e2267af5463285811d5fd0890ebc638f789512257817c1984f166
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2896	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2896	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2896	2700	regsvr32.exe	68
PID 2896 wrote to memory of 2620	2896	regsvr32.exe	69
PID 2896 wrote to memory of 2620	2896	regsvr32.exe	69
PID 2896 wrote to memory of 2620	2896	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e49f42cdaa75ac2bf3f6317e9ce91a1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5e49f42cdaa75ac2bf3f6317e9ce91a1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5e49f42cdaa75ac2bf3f6317e9ce91a1.dll",DllRegisterServer
    3⤵
    PID:2620

memory/2896-117-0x0000000003150000-0x0000000003175000-memory.dmp

Download