emotet | 047a8d71be91abf10a8a6b0dbcf9ade6ab76b8793c315330c16b134ff2b64b76

Analysis

Target
qreA8BDv5j166M2.dll
Size 784KB
Sample220126-ylek5shfcp
SHA256 047a8d71be91abf10a8a6b0dbcf9ade6ab76b8793c315330c16b134ff2b64b76
MD5 167002c2ca9ff52f8945df0c205fb9b3
SHA1 141a7a1242dbeb545a944b7acee0c35f4499263e
SHA512 fd2a2c431ea74993020468e6971ffb14a38efb9ab09c6e020da538ee95b1357d8453df7a9f74666bca656f0fc8ff03af74d0fd89e0e0c16726216277b89c8cf2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 348	380	regsvr32.exe	69
PID 380 wrote to memory of 348	380	regsvr32.exe	69
PID 380 wrote to memory of 348	380	regsvr32.exe	69
PID 348 wrote to memory of 1628	348	regsvr32.exe	70
PID 348 wrote to memory of 1628	348	regsvr32.exe	70
PID 348 wrote to memory of 1628	348	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\qreA8BDv5j166M2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\qreA8BDv5j166M2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\qreA8BDv5j166M2.dll",DllRegisterServer
    3⤵
    PID:1628

memory/348-115-0x0000000003600000-0x0000000003627000-memory.dmp

Download