emotet | a8ce03ef68ba64fb5c8a3b62758f67640f1ce11bbed8f4887e6371344bfc3c51

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_114541_PM_CST_2022.dll
Size 596KB
Sample220126-gqwlsaheej
SHA256 a8ce03ef68ba64fb5c8a3b62758f67640f1ce11bbed8f4887e6371344bfc3c51
MD5 913cac76aa41fb3291445230b48724d4
SHA1 2bb821150a308becc06e6a3322df4369b210decc
SHA512 a42beb87f3c52df39a103e7eddbbc3630ff33d40ee000a893437e5de2d08b98c9e1f1d758f43605fe6dd89458c0f6f2ec0d4d8da350a197a819cf9e942e834dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 2640	3800	regsvr32.exe	68
PID 3800 wrote to memory of 2640	3800	regsvr32.exe	68
PID 3800 wrote to memory of 2640	3800	regsvr32.exe	68
PID 2640 wrote to memory of 3740	2640	regsvr32.exe	69
PID 2640 wrote to memory of 3740	2640	regsvr32.exe	69
PID 2640 wrote to memory of 3740	2640	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114541_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114541_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_114541_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:3740

memory/2640-116-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download