emotet | 7c2e89427485c55ae688604de70e60fdbe603bd155b53168dc09284e1aee9827

Analysis

Target
DXXalH0ru169YZUM5.dll
Size 784KB
Sample220126-yleadaaae2
SHA256 7c2e89427485c55ae688604de70e60fdbe603bd155b53168dc09284e1aee9827
MD5 7474122c1affb90327d9fa14bf5f99dc
SHA1 49a5e5561cbda0bd3aeccc9d5972e9c4f816f288
SHA512 94ff3498320a828d3500e2063c5f835e1a4440388eea60e509aab386c82ead0844b5ec1a0ff431ec08e2091d1d74482699584802b909c709cd6dd6a61b5e32aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3684	3672	regsvr32.exe	69
PID 3672 wrote to memory of 3684	3672	regsvr32.exe	69
PID 3672 wrote to memory of 3684	3672	regsvr32.exe	69
PID 3684 wrote to memory of 4100	3684	regsvr32.exe	70
PID 3684 wrote to memory of 4100	3684	regsvr32.exe	70
PID 3684 wrote to memory of 4100	3684	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll",DllRegisterServer
    3⤵
    PID:4100

memory/3684-118-0x0000000004420000-0x0000000004447000-memory.dmp

Download