emotet | 9e576586f53c4032e18f3144b601193db9daf41ffa39e6ef5d0e63abb44a4796

Analysis

Target
86fcae916c58fad7d1064138711922f7.dll
Size 560KB
Sample220120-wmf49ababp
SHA256 9e576586f53c4032e18f3144b601193db9daf41ffa39e6ef5d0e63abb44a4796
MD5 86fcae916c58fad7d1064138711922f7
SHA1 25ea81c1b4831eb27b6d0c547883b28f51c46fca
SHA512 e9124105255ae896cf23012a83a36514addf2f950765aa739a4d11699f5a68517443a723b557bd5b44bba16d14b46dae52ac1836316210a7ff662f049bad59be
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1320	1184	regsvr32.exe	54
PID 1184 wrote to memory of 1320	1184	regsvr32.exe	54
PID 1184 wrote to memory of 1320	1184	regsvr32.exe	54
PID 1320 wrote to memory of 3668	1320	regsvr32.exe	55
PID 1320 wrote to memory of 3668	1320	regsvr32.exe	55
PID 1320 wrote to memory of 3668	1320	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86fcae916c58fad7d1064138711922f7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\86fcae916c58fad7d1064138711922f7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\86fcae916c58fad7d1064138711922f7.dll",DllRegisterServer
    3⤵
    PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:4068

memory/1320-133-0x00000000030E0000-0x0000000003108000-memory.dmp

Download