emotet | 199b4aecbb01ae573b295e5232b4292287b1f167a40d6df3df154eea806b34d0

Analysis

Target
a2200d69b077f26afbb223d01a33e29e.dll
Size 615KB
Sample220122-pt27qsbbep
SHA256 199b4aecbb01ae573b295e5232b4292287b1f167a40d6df3df154eea806b34d0
MD5 a2200d69b077f26afbb223d01a33e29e
SHA1 7d427d5da04f413310b4dff92b5b566f6597de07
SHA512 ec259a7d95689f4f76fd1418489e3a454a04c2a13d910b4b4713a2a34679255e0ae2ab29096a785fd998b1e86e604ecb4abd97b57d03a74b0dd0ee2f8da61c52
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2532	2344	regsvr32.exe	68
PID 2344 wrote to memory of 2532	2344	regsvr32.exe	68
PID 2344 wrote to memory of 2532	2344	regsvr32.exe	68
PID 2532 wrote to memory of 2724	2532	regsvr32.exe	69
PID 2532 wrote to memory of 2724	2532	regsvr32.exe	69
PID 2532 wrote to memory of 2724	2532	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a2200d69b077f26afbb223d01a33e29e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a2200d69b077f26afbb223d01a33e29e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a2200d69b077f26afbb223d01a33e29e.dll",DllRegisterServer
    3⤵
    PID:2724

memory/2532-116-0x0000000004560000-0x0000000004586000-memory.dmp

Download