emotet | 5fedb0cedcf68c4b91454acf841c2ad7362c2948008ab4d746bb049c46f44038

Analysis

Target
54a881494b0b98f9fc33bacc2940b22b.dll
Size 642KB
Sample220125-mjvc2aeagl
SHA256 5fedb0cedcf68c4b91454acf841c2ad7362c2948008ab4d746bb049c46f44038
MD5 54a881494b0b98f9fc33bacc2940b22b
SHA1 a45c5cb273da4e1ddaa942ba0f8979e9591f2830
SHA512 231e639edc4a44d406e45717821a8eb396e2dbae8107ef491e6497d84f4a1010e774186e0913a493a048d0c818cf3622f399f78d344c8a241114010ddd7335f6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3440	3380	regsvr32.exe	68
PID 3380 wrote to memory of 3440	3380	regsvr32.exe	68
PID 3380 wrote to memory of 3440	3380	regsvr32.exe	68
PID 3440 wrote to memory of 3628	3440	regsvr32.exe	69
PID 3440 wrote to memory of 3628	3440	regsvr32.exe	69
PID 3440 wrote to memory of 3628	3440	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\54a881494b0b98f9fc33bacc2940b22b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\54a881494b0b98f9fc33bacc2940b22b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\54a881494b0b98f9fc33bacc2940b22b.dll",DllRegisterServer
    3⤵
    PID:3628

memory/3440-115-0x00000000011A0000-0x00000000011C8000-memory.dmp

Download