emotet | 356d6ff7aad2a7d0f987eb4c0d3b5157d50e70369df2a5055b3fa842e642b8d5

Analysis

Target
triage_dropped_file.dll
Size 624KB
Sample220121-rb4c7ahfc3
SHA256 356d6ff7aad2a7d0f987eb4c0d3b5157d50e70369df2a5055b3fa842e642b8d5
MD5 04a5bd3e1ccc8e7e3eeb479ec8a2e467
SHA1 9b7e654582bf5e7955952dae7ec8ce35546be9f8
SHA512 840a8089f19cc5026cf7727f0f207e4b994302224954501e0d4196277008293cd763d17b8027ad16e1fce114536b1aae3403a5a53521ecfd031dd48b53bb867f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3064 wrote to memory of 664	3064	regsvr32.exe	69
PID 3064 wrote to memory of 664	3064	regsvr32.exe	69
PID 3064 wrote to memory of 664	3064	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll",DllRegisterServer
    3⤵
    PID:664

memory/3064-119-0x00000000026C0000-0x00000000026E6000-memory.dmp

Download