emotet | 8c5cd9820ea8eba077b52683cc33799d46e67e9526b53df24f88364af88284e7

Analysis

Target
930d0cee2d7816e04cf77e38ffa801ea.dll
Size 642KB
Sample220125-ld7whadaan
SHA256 8c5cd9820ea8eba077b52683cc33799d46e67e9526b53df24f88364af88284e7
MD5 930d0cee2d7816e04cf77e38ffa801ea
SHA1 a904b56e44c49dd02752e74e6620ee2100f16477
SHA512 a2b7e6c2008371d028c1e98f74834ad8befac5473d030f21e81c68163e7f639a261e78ef7852cd11763397b5f86af9530d9de3d5a543ad8bf7e02488b44168aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3676	3536	regsvr32.exe	68
PID 3536 wrote to memory of 3676	3536	regsvr32.exe	68
PID 3536 wrote to memory of 3676	3536	regsvr32.exe	68
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69
PID 3676 wrote to memory of 3648	3676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll",DllRegisterServer
    3⤵
    PID:3648

memory/3676-115-0x00000000048A0000-0x00000000048C8000-memory.dmp

Download