emotet | 12b14e1d093009f703a29394303f53d511ad4e41875f038c51cf075dcf3cfe4f

Analysis

Target
394093d2d087c69c24daddbc8d301024.dll
Size 615KB
Sample220122-qk384sbcd3
SHA256 12b14e1d093009f703a29394303f53d511ad4e41875f038c51cf075dcf3cfe4f
MD5 394093d2d087c69c24daddbc8d301024
SHA1 1fd2381dcfddfe1c496282b2a607c8f396992592
SHA512 ee6c578fcfd280b498c49de1bd4063683aad035e9d010c8959077935c10183e0b1a60f64fcc560cf133ac6db0d3e8f973e3f6b81b38a2de2e14b6d7e01c19a46
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2468	2416	regsvr32.exe	68
PID 2416 wrote to memory of 2468	2416	regsvr32.exe	68
PID 2416 wrote to memory of 2468	2416	regsvr32.exe	68
PID 2468 wrote to memory of 2744	2468	regsvr32.exe	69
PID 2468 wrote to memory of 2744	2468	regsvr32.exe	69
PID 2468 wrote to memory of 2744	2468	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\394093d2d087c69c24daddbc8d301024.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\394093d2d087c69c24daddbc8d301024.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\394093d2d087c69c24daddbc8d301024.dll",DllRegisterServer
    3⤵
    PID:2744

memory/2468-116-0x0000000004CE0000-0x0000000004D06000-memory.dmp

Download