emotet | 2d59b1cca0af311c7368ef8f088e5ac94ab499e175b5bb0d2226d60d0a2cd160

Analysis

Target
f67858c11fa5b1565f7500548ecb51de.dll
Size 408KB
Sample220119-qb3afsaack
SHA256 2d59b1cca0af311c7368ef8f088e5ac94ab499e175b5bb0d2226d60d0a2cd160
MD5 f67858c11fa5b1565f7500548ecb51de
SHA1 4b7daf0d13151caa10a4276d07b1aeff09ed3027
SHA512 df3deba1d5ac748ddafd0ee72bfe28ebbf81a82abf424fc41f8973e418bb498e3693d199bf3c96f4b0cf5e30801305cc88e9b664f2252c5aba871123cc3797ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 4088	364	regsvr32.exe	52
PID 364 wrote to memory of 4088	364	regsvr32.exe	52
PID 364 wrote to memory of 4088	364	regsvr32.exe	52
PID 4088 wrote to memory of 384	4088	regsvr32.exe	53
PID 4088 wrote to memory of 384	4088	regsvr32.exe	53
PID 4088 wrote to memory of 384	4088	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll",DllRegisterServer
    3⤵
    PID:384

memory/4088-130-0x0000000000CC0000-0x0000000000CE6000-memory.dmp

Download