emotet | 4890fa2f24374911bf4017da74dd124f2f13af60d398b95000cd5172b4bac65a

Analysis

Target
8b64e711b0895323e12d96f83f0abba8.dll
Size 705KB
Sample220126-rraqtaeca6
SHA256 4890fa2f24374911bf4017da74dd124f2f13af60d398b95000cd5172b4bac65a
MD5 8b64e711b0895323e12d96f83f0abba8
SHA1 9276578a2d4d8de24560cc313eaaa46904bce208
SHA512 c65e8f7a14f9020873f3a68ba92bd66d46d68c75c3a58f2ab4ab1d69d45651e4a0c6f23e9017512bddcc7a755e8de1e7c9f1a09044e75043aa39dd760628e697
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3240	3856	regsvr32.exe	69
PID 3856 wrote to memory of 3240	3856	regsvr32.exe	69
PID 3856 wrote to memory of 3240	3856	regsvr32.exe	69
PID 3240 wrote to memory of 1780	3240	regsvr32.exe	70
PID 3240 wrote to memory of 1780	3240	regsvr32.exe	70
PID 3240 wrote to memory of 1780	3240	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll",DllRegisterServer
    3⤵
    PID:1780

memory/3240-118-0x00000000047C0000-0x00000000047E5000-memory.dmp

Download