emotet | 296d60880e286fb0c7c4dbdc74dec97bbfabc267df4b410f2eb356740c3c809c

Analysis

Target
3c6377b2ed0a524c939b8c253d14fa59.dll
Size 596KB
Sample220125-wsllxscdej
SHA256 296d60880e286fb0c7c4dbdc74dec97bbfabc267df4b410f2eb356740c3c809c
MD5 3c6377b2ed0a524c939b8c253d14fa59
SHA1 d314352d286d79aab6db152f85b50624c89f79bf
SHA512 ac8ffa4234b73c4c447b3ccb5e1c1b776309e4dda8a8155a628b9807a958e01f3773a1bd62fb25eb6f8844d2fa09ed53e77f4ee405e4ee815e24dcf1efa93451
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2692	2668	regsvr32.exe	68
PID 2668 wrote to memory of 2692	2668	regsvr32.exe	68
PID 2668 wrote to memory of 2692	2668	regsvr32.exe	68
PID 2692 wrote to memory of 3152	2692	regsvr32.exe	69
PID 2692 wrote to memory of 3152	2692	regsvr32.exe	69
PID 2692 wrote to memory of 3152	2692	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c6377b2ed0a524c939b8c253d14fa59.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3c6377b2ed0a524c939b8c253d14fa59.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3c6377b2ed0a524c939b8c253d14fa59.dll",DllRegisterServer
    3⤵
    PID:3152

memory/2692-115-0x0000000004C60000-0x0000000004C87000-memory.dmp

Download