emotet | c5e53b814d58fc001b8923000b31f3f901dd67a14934b9a5b9fc8bef8a285a6b

Analysis

Target
8b7d85a5634c91a1fa7b1c7b51e68340.dll
Size 716KB
Sample220124-kfv42sdghj
SHA256 c5e53b814d58fc001b8923000b31f3f901dd67a14934b9a5b9fc8bef8a285a6b
MD5 8b7d85a5634c91a1fa7b1c7b51e68340
SHA1 eed07380c4765896c820b20ff711595f3534d289
SHA512 6c6056c84722da5b9d374f3e44ee8936a7895700d4889ddec1a4dd657cef8383fa2d3815bd84a0e8e95fef6ba5f2b7f2e47a369e6d9559a0312b6106103ad159
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 3992	3160	regsvr32.exe	69
PID 3160 wrote to memory of 3992	3160	regsvr32.exe	69
PID 3160 wrote to memory of 3992	3160	regsvr32.exe	69
PID 3992 wrote to memory of 1332	3992	regsvr32.exe	70
PID 3992 wrote to memory of 1332	3992	regsvr32.exe	70
PID 3992 wrote to memory of 1332	3992	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b7d85a5634c91a1fa7b1c7b51e68340.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b7d85a5634c91a1fa7b1c7b51e68340.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8b7d85a5634c91a1fa7b1c7b51e68340.dll",DllRegisterServer
    3⤵
    PID:1332

memory/3992-115-0x0000000004910000-0x0000000004936000-memory.dmp

Download