emotet | 8424f1cdda30b565f1905bbd4996ef49988388c3c73ee18e13ca6f794bdc90fe

Analysis

Target
ac1e9bc8492fc9a6fb749886352792d5.dll
Size 784KB
Sample220126-vn422agbd3
SHA256 8424f1cdda30b565f1905bbd4996ef49988388c3c73ee18e13ca6f794bdc90fe
MD5 ac1e9bc8492fc9a6fb749886352792d5
SHA1 f0689b02fc9482df5a3deb4a8be1d1383bdca73c
SHA512 9f3f6a432af807e6548fcb1330c105909382da9c4990ff7be86bed835b19e464618d55969af1d2282c49aa442d621fb95d36df62679e626e0bef34b3e8f422e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2780	2728	regsvr32.exe	68
PID 2728 wrote to memory of 2780	2728	regsvr32.exe	68
PID 2728 wrote to memory of 2780	2728	regsvr32.exe	68
PID 2780 wrote to memory of 3140	2780	regsvr32.exe	69
PID 2780 wrote to memory of 3140	2780	regsvr32.exe	69
PID 2780 wrote to memory of 3140	2780	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll",DllRegisterServer
    3⤵
    PID:3140

memory/2780-118-0x0000000004560000-0x0000000004587000-memory.dmp

Download