emotet | 48274d12184be8075ea39035ea564d8281af4bb65ff7414cb4cb91355975c46a

Analysis

Target
a1b58b3f30f27737a40816e1f7bd14e8.dll
Size 496KB
Sample220126-23zt7acac5
SHA256 48274d12184be8075ea39035ea564d8281af4bb65ff7414cb4cb91355975c46a
MD5 a1b58b3f30f27737a40816e1f7bd14e8
SHA1 e065759c091cc78de97b7f91a35f8e97d0d4c8ab
SHA512 1114954676834cc0a0567f11908ab87cf40f29084f5a0118c0beac6cd61581c52d6f6cb42e0135e411ec750c892684835f475cfcb71b39d9478ba01948a3fea7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3068	2656	regsvr32.exe	68
PID 2656 wrote to memory of 3068	2656	regsvr32.exe	68
PID 2656 wrote to memory of 3068	2656	regsvr32.exe	68
PID 3068 wrote to memory of 3628	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3628	3068	regsvr32.exe	69
PID 3068 wrote to memory of 3628	3068	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a1b58b3f30f27737a40816e1f7bd14e8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a1b58b3f30f27737a40816e1f7bd14e8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a1b58b3f30f27737a40816e1f7bd14e8.dll",DllRegisterServer
    3⤵
    PID:3628

memory/3068-119-0x0000000004960000-0x0000000004985000-memory.dmp

Download