emotet | 2abc40ff591b795b206cf83a0f52eaf56b4d94f0c91ac895fd7bcfcaaece787c

Analysis

Target
94cacd4b138abc1a6063e5dd4c6cfd0a.dll
Size 496KB
Sample220127-ahr53achf8
SHA256 2abc40ff591b795b206cf83a0f52eaf56b4d94f0c91ac895fd7bcfcaaece787c
MD5 94cacd4b138abc1a6063e5dd4c6cfd0a
SHA1 5aff011f97c270445586bcaae7688900ab430bbb
SHA512 a72149c79fcf7db9ee38f57d1687e4d4786f706852d1966da5ac11c73304d817d4d70e12553bec144fd90fcf0aba73bf3073d8540c9e4e213881e760008285ee
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2740	2424	regsvr32.exe	68
PID 2424 wrote to memory of 2740	2424	regsvr32.exe	68
PID 2424 wrote to memory of 2740	2424	regsvr32.exe	68
PID 2740 wrote to memory of 3740	2740	regsvr32.exe	69
PID 2740 wrote to memory of 3740	2740	regsvr32.exe	69
PID 2740 wrote to memory of 3740	2740	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\94cacd4b138abc1a6063e5dd4c6cfd0a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\94cacd4b138abc1a6063e5dd4c6cfd0a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\94cacd4b138abc1a6063e5dd4c6cfd0a.dll",DllRegisterServer
    3⤵
    PID:3740

memory/2740-118-0x00000000010C0000-0x00000000010E5000-memory.dmp

Download