emotet | c42e11938bb550def11f59a8cbaf8ce863c2d7be9881010b8109bf0bc966fe30

Analysis

Target
58179d524641052af9e19b398f81ba41.dll
Size 660KB
Sample220125-trc72sahd7
SHA256 c42e11938bb550def11f59a8cbaf8ce863c2d7be9881010b8109bf0bc966fe30
MD5 58179d524641052af9e19b398f81ba41
SHA1 a4401ae72cf319934290c55e75c8a7e9c3f2df7f
SHA512 a01c1f33755fd7ec9ce0e4ad6eb8f9d224627702de53b306d061abee6680bd5322995b02f4b977ca3d81e5162018b9c30bfc99f49c1e0d61d0310338c3140300
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1692	2656	regsvr32.exe	68
PID 2656 wrote to memory of 1692	2656	regsvr32.exe	68
PID 2656 wrote to memory of 1692	2656	regsvr32.exe	68
PID 1692 wrote to memory of 1964	1692	regsvr32.exe	69
PID 1692 wrote to memory of 1964	1692	regsvr32.exe	69
PID 1692 wrote to memory of 1964	1692	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\58179d524641052af9e19b398f81ba41.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\58179d524641052af9e19b398f81ba41.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\58179d524641052af9e19b398f81ba41.dll",DllRegisterServer
    3⤵
    PID:1964

memory/1692-117-0x0000000000BC0000-0x0000000000BE5000-memory.dmp

Download