emotet | 628120061efc42a326f48c32bfc513f96da3ff6be8e05c100a2958dd83e5f4c2

Analysis

Target
7ffe90c5c5919145246925dec4ed6d2e.dll
Size 784KB
Sample220126-wlb4xagff3
SHA256 628120061efc42a326f48c32bfc513f96da3ff6be8e05c100a2958dd83e5f4c2
MD5 7ffe90c5c5919145246925dec4ed6d2e
SHA1 10671e8183de3806fabd65bb77fdba624b0d3799
SHA512 d3535816ab0f9ebb98a4393b2771bf2d597ff03d4009f6977c06d5b95ca5e4068755afc72f51e18b1086527bb171dbf657c8908c197f5692814153301415fb03
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2796 wrote to memory of 428	2796	regsvr32.exe	69
PID 2796 wrote to memory of 428	2796	regsvr32.exe	69
PID 2796 wrote to memory of 428	2796	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ffe90c5c5919145246925dec4ed6d2e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7ffe90c5c5919145246925dec4ed6d2e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7ffe90c5c5919145246925dec4ed6d2e.dll",DllRegisterServer
    3⤵
    PID:428

memory/2796-116-0x0000000004EC0000-0x0000000004EE7000-memory.dmp

Download