emotet | 94df254aeb8a2d3bc8a1caa4df21e53878eda3bda7205f306320dd332ca890b1

Analysis

Target
dbe48552cb2216840a44e2d9da835de0.dll
Size 398KB
Sample220118-x5376scghm
SHA256 94df254aeb8a2d3bc8a1caa4df21e53878eda3bda7205f306320dd332ca890b1
MD5 dbe48552cb2216840a44e2d9da835de0
SHA1 91ab44a392ba3261e7a6065ff14ba32c700632b4
SHA512 fe8af85a9598905c5cb2b42d443f70a360b51bd0f4e0a04efedcf13dc0da439361b41d8fcc45805625d63eb977790969332980eba6d8f8c178c796917d9e0acd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2740	4084	regsvr32.exe	52
PID 4084 wrote to memory of 2740	4084	regsvr32.exe	52
PID 4084 wrote to memory of 2740	4084	regsvr32.exe	52
PID 2740 wrote to memory of 452	2740	regsvr32.exe	53
PID 2740 wrote to memory of 452	2740	regsvr32.exe	53
PID 2740 wrote to memory of 452	2740	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbe48552cb2216840a44e2d9da835de0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dbe48552cb2216840a44e2d9da835de0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dbe48552cb2216840a44e2d9da835de0.dll",DllRegisterServer
    3⤵
    PID:452

memory/2740-130-0x00000000045E0000-0x0000000004606000-memory.dmp

Download