emotet | 3364a1fad21b56269eb7d4ee9edcc7fc41bde56a3cbfb1462096b09f140ad49b

Analysis

Target
dc90f8831cacefce583e91710b891239.dll
Size 512KB
Sample220127-2sv39acfe5
SHA256 3364a1fad21b56269eb7d4ee9edcc7fc41bde56a3cbfb1462096b09f140ad49b
MD5 dc90f8831cacefce583e91710b891239
SHA1 295bea1a74c95b73fbddc6a02309e8f06c52b35d
SHA512 8be95d59c2bea29732aa3d10a298043b3b75473af94d3c326b9b7690ec5bdc3eb7d364ab6241a4f1adb318a149ff5284ad2d2005b53aa868ef8a238ed356e2e9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4092 wrote to memory of 4072	4092	regsvr32.exe	69
PID 4072 wrote to memory of 2692	4072	regsvr32.exe	70
PID 4072 wrote to memory of 2692	4072	regsvr32.exe	70
PID 4072 wrote to memory of 2692	4072	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll",DllRegisterServer
    3⤵
    PID:2692

memory/4072-118-0x00000000011E0000-0x0000000001205000-memory.dmp

Download