emotet | 67beaed439224240e6089816e1a22732382edad828c19d599aff6690e354d447

Analysis

Target
9e6a4be471a4c4d75020375bec06b0e1.dll
Size 408KB
Sample220119-j1msqsgba9
SHA256 67beaed439224240e6089816e1a22732382edad828c19d599aff6690e354d447
MD5 9e6a4be471a4c4d75020375bec06b0e1
SHA1 3f25e25a647e3732f56e9476fb3eb23ec87806b3
SHA512 60dccb74b5015e0032a19cf3665f70d33db821328cad4595db363ce67f43a52c36b080e7ca72325a54810279ae89ea58433ad7c7290911828f199f6ab466c6be
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3088	2168	regsvr32.exe	51
PID 2168 wrote to memory of 3088	2168	regsvr32.exe	51
PID 2168 wrote to memory of 3088	2168	regsvr32.exe	51
PID 3088 wrote to memory of 3452	3088	regsvr32.exe	52
PID 3088 wrote to memory of 3452	3088	regsvr32.exe	52
PID 3088 wrote to memory of 3452	3088	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e6a4be471a4c4d75020375bec06b0e1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e6a4be471a4c4d75020375bec06b0e1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9e6a4be471a4c4d75020375bec06b0e1.dll",DllRegisterServer
    3⤵
    PID:3452

memory/3088-130-0x0000000002C80000-0x0000000002CA8000-memory.dmp

Download