emotet | 0b4e7c33f8930e7f16dc42b6647283a3cb0a4a5c095ef0430e08945af1484dfb

Analysis

Target
d28c5c721f30f446e7881e78637f507f.dll
Size 408KB
Sample220119-j1msqsgba8
SHA256 0b4e7c33f8930e7f16dc42b6647283a3cb0a4a5c095ef0430e08945af1484dfb
MD5 d28c5c721f30f446e7881e78637f507f
SHA1 8e9e44d557dbf58bc54b31773b9defd0f863bbce
SHA512 5a81c9ac8c39e74c42750c5640fe022b16c483e25eda775d0580edb408c0e136b52012f6721b4afd8154c6870ad72ef1552b959a2a57035329b902f636b22fe4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1256	2960	regsvr32.exe	52
PID 2960 wrote to memory of 1256	2960	regsvr32.exe	52
PID 2960 wrote to memory of 1256	2960	regsvr32.exe	52
PID 1256 wrote to memory of 1544	1256	regsvr32.exe	54
PID 1256 wrote to memory of 1544	1256	regsvr32.exe	54
PID 1256 wrote to memory of 1544	1256	regsvr32.exe	54

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d28c5c721f30f446e7881e78637f507f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d28c5c721f30f446e7881e78637f507f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d28c5c721f30f446e7881e78637f507f.dll",DllRegisterServer
    3⤵
    PID:1544

memory/1256-130-0x0000000000A90000-0x0000000000AB8000-memory.dmp

Download