emotet | ce577b2606bda6a496991598ff294d3a1e90132b243c6cb2fc5eb6543366f83a

Analysis

Target
bfbe1cbaba2219a7628af4a648fea6d1.dll
Size 642KB
Sample220125-s23d9aabal
SHA256 ce577b2606bda6a496991598ff294d3a1e90132b243c6cb2fc5eb6543366f83a
MD5 bfbe1cbaba2219a7628af4a648fea6d1
SHA1 419037f6c220b69e247ee9787d8d13aadb9bf0a6
SHA512 9ceaa2c41dba12491b1a937d1fcd99ac63eb222420334434f7dc53db7f5877a1715966367ceca05a688696c1250102c91a6708bd503b3fd071ef1faab99e696d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3532	2836	regsvr32.exe	68
PID 2836 wrote to memory of 3532	2836	regsvr32.exe	68
PID 2836 wrote to memory of 3532	2836	regsvr32.exe	68
PID 3532 wrote to memory of 2764	3532	regsvr32.exe	69
PID 3532 wrote to memory of 2764	3532	regsvr32.exe	69
PID 3532 wrote to memory of 2764	3532	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll",DllRegisterServer
    3⤵
    PID:2764

memory/3532-118-0x0000000004A30000-0x0000000004A58000-memory.dmp

Download