emotet | ab5eb24c0d89f3d5eb0f223f0a366ca92e94e4c70db2c7c08586605189eb9d18

Analysis

Target
7753d6592a3391470407270d30d556b9.dll
Size 615KB
Sample220122-qk384sbcd4
SHA256 ab5eb24c0d89f3d5eb0f223f0a366ca92e94e4c70db2c7c08586605189eb9d18
MD5 7753d6592a3391470407270d30d556b9
SHA1 50710c44603919c406eef833f19b059fa4b65993
SHA512 cb5f3d0413474532065d5f5753c460b943b1cbd9582552b062cc75ecdaea1206d41c2a4b7b5c7624bee3a85563913ff0c2067f72f8c5f55121de594b096ab6e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69
PID 3668 wrote to memory of 3592	3668	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll",DllRegisterServer
    3⤵
    PID:3592

memory/3668-119-0x0000000004A40000-0x0000000004A66000-memory.dmp

Download