emotet | 89f64cb155d3597bd0afa74c8fbac93bf410f88ee3fdbf4843b272efd8b62b67

Analysis

Target
19v1TPeCeoBpW5.dll
Size 784KB
Sample220126-qndsmadbbm
SHA256 89f64cb155d3597bd0afa74c8fbac93bf410f88ee3fdbf4843b272efd8b62b67
MD5 ca9ea0b16b728998114d4a4421b1c6e2
SHA1 099ea58c2671f068b6f85ed8f6f68536d9e597bb
SHA512 298390ef42266a6a431e286d2cf243fd0c3a4f0dcb2a6c076a804b26a5f5f76f68cf2416adb92fac4a4583a5391ee43d73ff69ce98e3287774f8b5ffec256b9d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2652	3204	regsvr32.exe	68
PID 3204 wrote to memory of 2652	3204	regsvr32.exe	68
PID 3204 wrote to memory of 2652	3204	regsvr32.exe	68
PID 2652 wrote to memory of 3496	2652	regsvr32.exe	69
PID 2652 wrote to memory of 3496	2652	regsvr32.exe	69
PID 2652 wrote to memory of 3496	2652	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19v1TPeCeoBpW5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\19v1TPeCeoBpW5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\19v1TPeCeoBpW5.dll",DllRegisterServer
    3⤵
    PID:3496

memory/2652-115-0x0000000000E10000-0x0000000000E37000-memory.dmp

Download