emotet | 465a10b13ca487b8aee37eb4262bf9afd968a3eff3eaa148bbf07720c01f0a19

Analysis

Target
abea5c5eac18363ead0c32df32b95191.dll
Size 784KB
Sample220126-k97d6sbfb6
SHA256 465a10b13ca487b8aee37eb4262bf9afd968a3eff3eaa148bbf07720c01f0a19
MD5 abea5c5eac18363ead0c32df32b95191
SHA1 27e6af285dafd20488b73139c3cfa4b507139444
SHA512 b6a814029fda5e97f7a8fba537c74ebe83a093ebaa374adef49fd2136c8b7a7c1d89adafafb9ef560ee7d909efce1449a4f7778cb47e2e8983334e9e2c023149
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 3956	3808	regsvr32.exe	69
PID 3808 wrote to memory of 3956	3808	regsvr32.exe	69
PID 3808 wrote to memory of 3956	3808	regsvr32.exe	69
PID 3956 wrote to memory of 1320	3956	regsvr32.exe	70
PID 3956 wrote to memory of 1320	3956	regsvr32.exe	70
PID 3956 wrote to memory of 1320	3956	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\abea5c5eac18363ead0c32df32b95191.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\abea5c5eac18363ead0c32df32b95191.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\abea5c5eac18363ead0c32df32b95191.dll",DllRegisterServer
    3⤵
    PID:1320

memory/3956-115-0x00000000047A0000-0x00000000047C7000-memory.dmp

Download