emotet | a0b651b04793579490c76c8db359a2bbefdd3b88b147698d594d7802c23330b1

Analysis

Target
8bcb6d7f4968e690a79bcdf9ac24e65a.dll
Size 780KB
Sample220125-ld769sdbb7
SHA256 a0b651b04793579490c76c8db359a2bbefdd3b88b147698d594d7802c23330b1
MD5 8bcb6d7f4968e690a79bcdf9ac24e65a
SHA1 81ff008b4c66eb4fb4a7db5fef037be2ed17a0df
SHA512 c4b92252d43e1014d2ac88775908fc75a9230bf694e3231d5cca293ce8e855ff2294300fe4622f787dd55ec6eded87fa43b9abb06159cd4e67b6d64470b23de4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2748	2692	regsvr32.exe	68
PID 2692 wrote to memory of 2748	2692	regsvr32.exe	68
PID 2692 wrote to memory of 2748	2692	regsvr32.exe	68
PID 2748 wrote to memory of 3440	2748	regsvr32.exe	69
PID 2748 wrote to memory of 3440	2748	regsvr32.exe	69
PID 2748 wrote to memory of 3440	2748	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8bcb6d7f4968e690a79bcdf9ac24e65a.dll",DllRegisterServer
    3⤵
    PID:3440

memory/2748-115-0x0000000004840000-0x0000000004865000-memory.dmp

Download