emotet | 46e9cdaabdbfaac4ecfe4b4f34cf3cc5374aa9e3a27a0edf437bf41a99682da7

Analysis

Target
9c7a4c567f80b3e1ca0f6c351b5cec24.dll
Size 780KB
Sample220125-ld7whadbb6
SHA256 46e9cdaabdbfaac4ecfe4b4f34cf3cc5374aa9e3a27a0edf437bf41a99682da7
MD5 9c7a4c567f80b3e1ca0f6c351b5cec24
SHA1 9fca50eb9c1ddb9c324f35c162c1c64495f7dfbe
SHA512 50958c588a5c346d8fd5616030f5fce3aae407f6ea4b8de48ff670779028da51c809907658269cf2df98e31955cbd2e3d7da418f422799d50af4fc8314149f08
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2836	2668	regsvr32.exe	68
PID 2668 wrote to memory of 2836	2668	regsvr32.exe	68
PID 2668 wrote to memory of 2836	2668	regsvr32.exe	68
PID 2836 wrote to memory of 3488	2836	regsvr32.exe	69
PID 2836 wrote to memory of 3488	2836	regsvr32.exe	69
PID 2836 wrote to memory of 3488	2836	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c7a4c567f80b3e1ca0f6c351b5cec24.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9c7a4c567f80b3e1ca0f6c351b5cec24.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9c7a4c567f80b3e1ca0f6c351b5cec24.dll",DllRegisterServer
    3⤵
    PID:3488

memory/2836-118-0x0000000000E60000-0x0000000000E85000-memory.dmp

Download