emotet | a6cefe2b895d668adf8327fd1ae3d50eb135c7abb247e6e48a14dfbbca52862f

Analysis

Target
F0Vp8hugsh.dll
Size 705KB
Sample220126-v27ebafghj
SHA256 a6cefe2b895d668adf8327fd1ae3d50eb135c7abb247e6e48a14dfbbca52862f
MD5 fe9e31c9866ce3957f16400adeabd932
SHA1 608d35b874b1cc874b98096e77e48453814f2d87
SHA512 62eb8562e6591acf27e53177e21bb0002f0698f88e196128f02a337ffae00739e9fa4c07e6b17104ffc3079aaa5b06ffc5c923e496fe2f8e5e34872f3cf78e03
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28
PID 612 wrote to memory of 524	612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll",DllRegisterServer
    3⤵
    PID:524

memory/612-56-0x0000000075021000-0x0000000075023000-memory.dmp

Download

memory/612-57-0x0000000000410000-0x0000000000435000-memory.dmp

Download

memory/1272-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Download