emotet | b41b021062a852cc2db72da07bdfd4c2ab8c98f158cbf5d2d9cc696fa11def07

Analysis

Target
30c6fb8fb722aa4ce682debddd97724b.dll
Size 408KB
Sample220118-2sa33sdggq
SHA256 b41b021062a852cc2db72da07bdfd4c2ab8c98f158cbf5d2d9cc696fa11def07
MD5 30c6fb8fb722aa4ce682debddd97724b
SHA1 25a3138dd9a3818b5d563e63c6701259132e1832
SHA512 cc1e4d19f865d4fb21335b24444ad29d762662155824357b596fde6ef17b702a1ea0e5d46c949ec6e2a0a86523911d54c8cd4969c2d03da8a53d68c73b07c929
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3764	4012	regsvr32.exe	52
PID 4012 wrote to memory of 3764	4012	regsvr32.exe	52
PID 4012 wrote to memory of 3764	4012	regsvr32.exe	52
PID 3764 wrote to memory of 452	3764	regsvr32.exe	53
PID 3764 wrote to memory of 452	3764	regsvr32.exe	53
PID 3764 wrote to memory of 452	3764	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll",DllRegisterServer
    3⤵
    PID:452

memory/3764-133-0x0000000004990000-0x00000000049B8000-memory.dmp

Download