emotet | 314fdf17e15faca94d9ede9b4213b0fe2c00a42a0d266643734fed2ae15d3c37

Analysis

Target
e9373da0cc8f910f5690af039dfd7e08.dll
Size 408KB
Sample220119-ql9saaabcr
SHA256 314fdf17e15faca94d9ede9b4213b0fe2c00a42a0d266643734fed2ae15d3c37
MD5 e9373da0cc8f910f5690af039dfd7e08
SHA1 9202b4165157b0f962a43edafc08326a8e4140f2
SHA512 2e0d49c6ac987a965522118e166a5e2d9d32427ce7fed9d1bba46832856937c864d2bfa6f56bc4b46c23a7afe920fc9e4ecb04002a4d2f02628f708099833de7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3504	2300	regsvr32.exe	53
PID 2300 wrote to memory of 3504	2300	regsvr32.exe	53
PID 2300 wrote to memory of 3504	2300	regsvr32.exe	53
PID 3504 wrote to memory of 2564	3504	regsvr32.exe	59
PID 3504 wrote to memory of 2564	3504	regsvr32.exe	59
PID 3504 wrote to memory of 2564	3504	regsvr32.exe	59

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e9373da0cc8f910f5690af039dfd7e08.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e9373da0cc8f910f5690af039dfd7e08.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e9373da0cc8f910f5690af039dfd7e08.dll",DllRegisterServer
    3⤵
    PID:2564

memory/3504-130-0x00000000031C0000-0x00000000031E6000-memory.dmp

Download