emotet | 8fe2e2b3412421eae6219dc4557a7deeb581ef38dbd827bc655e5b644d5004f1

Analysis

Target
6713d0dc4b2dc3617de455598a44a725.dll
Size 780KB
Sample220124-2m8r6abfcj
SHA256 8fe2e2b3412421eae6219dc4557a7deeb581ef38dbd827bc655e5b644d5004f1
MD5 6713d0dc4b2dc3617de455598a44a725
SHA1 3ff553d62e293db4962ebd730cbc7354ae927c44
SHA512 cd26b309a917efd7692a5d5606a3441464335120212d9423c28827701bff85df7684cae1c169b535bacc6c5c6795c9ac44efce38eb27276f5e6558c4cf546239
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4092	3464	regsvr32.exe	68
PID 3464 wrote to memory of 4092	3464	regsvr32.exe	68
PID 3464 wrote to memory of 4092	3464	regsvr32.exe	68
PID 4092 wrote to memory of 4176	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4176	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4176	4092	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6713d0dc4b2dc3617de455598a44a725.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6713d0dc4b2dc3617de455598a44a725.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6713d0dc4b2dc3617de455598a44a725.dll",DllRegisterServer
    3⤵
    PID:4176

memory/4092-118-0x0000000004F60000-0x0000000004F85000-memory.dmp

Download