emotet | e7f1f5ca2f1143056e07fabde32e4d0fb1b46d7674353f5dd408ff3d5290e2ca

Analysis

Target
FThzAWsvUOadhDU.dll
Size 784KB
Sample220126-qpj12adbbp
SHA256 e7f1f5ca2f1143056e07fabde32e4d0fb1b46d7674353f5dd408ff3d5290e2ca
MD5 6ae3e83accca668c03d34ce51a48a4a5
SHA1 4920ad88b2a99ac6e8408dec222a54f9ea831d16
SHA512 dd459ac814a2693e5cadc7d6f4d2d9c6192f420e94fe3c4cb059a07b5f81834d41c3f11fd6ed10d00812920911802aeb51c77bcc5f1bda45dce559ab9f28bab7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 68 wrote to memory of 3176	68	regsvr32.exe	69
PID 68 wrote to memory of 3176	68	regsvr32.exe	69
PID 68 wrote to memory of 3176	68	regsvr32.exe	69
PID 3176 wrote to memory of 2692	3176	regsvr32.exe	70
PID 3176 wrote to memory of 2692	3176	regsvr32.exe	70
PID 3176 wrote to memory of 2692	3176	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\FThzAWsvUOadhDU.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:68
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\FThzAWsvUOadhDU.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\FThzAWsvUOadhDU.dll",DllRegisterServer
    3⤵
    PID:2692

memory/3176-115-0x0000000000FA0000-0x0000000000FC7000-memory.dmp

Download