emotet | e1a55a327c7c2c1a5d215f9e13d836ada2fef0aecf12013fea68469920020106

Analysis

Target
XRkuPnNPMWjG2ffyf5.dll
Size 784KB
Sample220126-naweeacbbn
SHA256 e1a55a327c7c2c1a5d215f9e13d836ada2fef0aecf12013fea68469920020106
MD5 d44f76e2552fb7e313aa81ce996ad94f
SHA1 0a981cec91868615bc361dc1353d38f7238881a6
SHA512 2b0f3c07c86037449600de7ef32afd6a5d5ca8e60a513fa9a7122f23809f967aafc35af9b6c71cd7e74b01534cd3ae9831ff2c0cc77b663fa5e96b61abbdcb96
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3440	1480	regsvr32.exe	68
PID 1480 wrote to memory of 3440	1480	regsvr32.exe	68
PID 1480 wrote to memory of 3440	1480	regsvr32.exe	68
PID 3440 wrote to memory of 3816	3440	regsvr32.exe	69
PID 3440 wrote to memory of 3816	3440	regsvr32.exe	69
PID 3440 wrote to memory of 3816	3440	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll",DllRegisterServer
    3⤵
    PID:3816

memory/3440-116-0x0000000004AD0000-0x0000000004AF7000-memory.dmp

Download