emotet | ee1e69f01973b4bda2fe0d39987a50043741419c8a44c7c26ed277e41b00a8a3

Analysis

Target
5ab27c7ffc8dfe8e981fcab1dbfcda70.dll
Size 780KB
Sample220125-mby19adhbp
SHA256 ee1e69f01973b4bda2fe0d39987a50043741419c8a44c7c26ed277e41b00a8a3
MD5 5ab27c7ffc8dfe8e981fcab1dbfcda70
SHA1 ee7977333cb773c57b29ac474b11a7555c8549e6
SHA512 0cba138c24b12c25e7c6763afff3aa62caac8c9ad36348d434daa86932470744f33665f13377e6e63405bbb5e142956991521f5211b1274d73320d8e1e86c763
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 668	3312	regsvr32.exe	69
PID 3312 wrote to memory of 668	3312	regsvr32.exe	69
PID 3312 wrote to memory of 668	3312	regsvr32.exe	69
PID 668 wrote to memory of 708	668	regsvr32.exe	70
PID 668 wrote to memory of 708	668	regsvr32.exe	70
PID 668 wrote to memory of 708	668	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ab27c7ffc8dfe8e981fcab1dbfcda70.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ab27c7ffc8dfe8e981fcab1dbfcda70.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5ab27c7ffc8dfe8e981fcab1dbfcda70.dll",DllRegisterServer
    3⤵
    PID:708

memory/668-115-0x0000000004880000-0x00000000048A5000-memory.dmp

Download