emotet | 3d46d69a3cb137e443329c73e8551dcfaa471bc271d891703850a0c931faacd8

Analysis

Target
2054474965.dll
Size 805KB
Sample220113-26rb8adbhl
SHA256 3d46d69a3cb137e443329c73e8551dcfaa471bc271d891703850a0c931faacd8
MD5 f2eae85e0cb5640e1c51e2e1e9e01606
SHA1 e17b2e1c08b9676f5ab30018b59301aacdeb534f
SHA512 71c04507e5f549fe59b6e6b56d6fa5c4b347839a26ddeb45d3198bc7e38622a22ac3330d407b86421fc4cf618464f357a12639c2e6e96fd3683c470d0ff9e4e9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 1008	660	regsvr32.exe	69
PID 660 wrote to memory of 1008	660	regsvr32.exe	69
PID 660 wrote to memory of 1008	660	regsvr32.exe	69
PID 1008 wrote to memory of 808	1008	regsvr32.exe	70
PID 1008 wrote to memory of 808	1008	regsvr32.exe	70
PID 1008 wrote to memory of 808	1008	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2054474965.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2054474965.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2054474965.dll",DllRegisterServer
    3⤵
    PID:808

memory/1008-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download