emotet | 1f8af3f6a12742c957f9d2ca23af244882efedbfa9398beaf90c003bd07147fe

Analysis

Target
QJ0hqh8OfSqL.dll
Size 784KB
Sample220126-ylek5shfcn
SHA256 1f8af3f6a12742c957f9d2ca23af244882efedbfa9398beaf90c003bd07147fe
MD5 1db84103db666ebf75ae318a076b6f73
SHA1 c601f997df2dea0463a88e509111d4b68920c30b
SHA512 06d769eddb0f0b9e4cbaaad21fee9ad13f23a42b3b321c1ee475abb36f6c82c72368f6861557693233bd77e477f92d87276c63a74d839842eb24524d487899e2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 848 wrote to memory of 1068	848	regsvr32.exe	27
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28
PID 1068 wrote to memory of 476	1068	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll",DllRegisterServer
    3⤵
    PID:476

memory/848-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Download

memory/1068-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/1068-56-0x00000000003A0000-0x00000000003C7000-memory.dmp

Download