emotet | cb897010a33eef9d8a42b82987299f5a5ae0fe359efa38cf724701877334c161

Analysis

Target
83a6e296c76cce64ecd52173c905c2c3.dll
Size 612KB
Sample220121-sxg8hsaaa2
SHA256 cb897010a33eef9d8a42b82987299f5a5ae0fe359efa38cf724701877334c161
MD5 83a6e296c76cce64ecd52173c905c2c3
SHA1 c223a2f327e16c20460f7062c5e2aeafb0d1fefc
SHA512 54c1fe11ca3155af7d8bec8317897c8f023f193c1252847a4840734c79e787513e1881a64aef036d7a78a2cf7a95833e3aa673a1c31d6ba08757dc727040cea6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3344	3444	regsvr32.exe	68
PID 3444 wrote to memory of 3344	3444	regsvr32.exe	68
PID 3444 wrote to memory of 3344	3444	regsvr32.exe	68
PID 3344 wrote to memory of 3628	3344	regsvr32.exe	69
PID 3344 wrote to memory of 3628	3344	regsvr32.exe	69
PID 3344 wrote to memory of 3628	3344	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83a6e296c76cce64ecd52173c905c2c3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\83a6e296c76cce64ecd52173c905c2c3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\83a6e296c76cce64ecd52173c905c2c3.dll",DllRegisterServer
    3⤵
    PID:3628

memory/3344-116-0x0000000004AB0000-0x0000000004AD6000-memory.dmp

Download