emotet | 790f0271e82cc06ab5d1881fcf87177fba0be88481bab3eeddbaa1145d4d938e

Analysis

Target
c124fbad7e93a241902a6b6f924f79e2.dll
Size 705KB
Sample220126-tmdm1sfaak
SHA256 790f0271e82cc06ab5d1881fcf87177fba0be88481bab3eeddbaa1145d4d938e
MD5 c124fbad7e93a241902a6b6f924f79e2
SHA1 19e110eb8db9f7d24b64e8a554b7adff4a41652b
SHA512 8040e4fb0d767f8f250ee28b833ca0691db88ed6789f48707cec3f56234f52fdbdbbeeba337bf324cfded64cf111e372d61de34564e18e44b5b34e327e9e4b20
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 492	2336	regsvr32.exe	69
PID 2336 wrote to memory of 492	2336	regsvr32.exe	69
PID 2336 wrote to memory of 492	2336	regsvr32.exe	69
PID 492 wrote to memory of 1296	492	regsvr32.exe	70
PID 492 wrote to memory of 1296	492	regsvr32.exe	70
PID 492 wrote to memory of 1296	492	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c124fbad7e93a241902a6b6f924f79e2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c124fbad7e93a241902a6b6f924f79e2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c124fbad7e93a241902a6b6f924f79e2.dll",DllRegisterServer
    3⤵
    PID:1296

memory/492-115-0x0000000004820000-0x0000000004845000-memory.dmp

Download