emotet | e39bda1e5d4f990da43aad6b5ddd94ec34b189f4ed0eca1771a1ffae6a82995b

Analysis

Target
D4cEFfIh8TP.dll
Size 612KB
Sample220121-wyrp5aahdn
SHA256 e39bda1e5d4f990da43aad6b5ddd94ec34b189f4ed0eca1771a1ffae6a82995b
MD5 c6d8d14d9a9f4649695fb9ddfeb60c0a
SHA1 4a1580e8939656fa10a5ac57a38dab14e2c86abb
SHA512 bc736e3326bbb36a51903d292d395cb131c56f086b3325eb3ccb52ff2006453d58b931fa20b709abe58a9b0a718fac0ef2d086a1c3432429760bade15c76741a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4032	3796	regsvr32.exe	69
PID 3796 wrote to memory of 4032	3796	regsvr32.exe	69
PID 3796 wrote to memory of 4032	3796	regsvr32.exe	69
PID 4032 wrote to memory of 3668	4032	regsvr32.exe	70
PID 4032 wrote to memory of 3668	4032	regsvr32.exe	70
PID 4032 wrote to memory of 3668	4032	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll",DllRegisterServer
    3⤵
    PID:3668

memory/4032-115-0x0000000000D00000-0x0000000000D26000-memory.dmp

Download