emotet | 4988437bbc5303fb773e6bb1a56b1a8f2f693a6accad0fbededd2cfb44824ad6

Analysis

Target
89b03290d8ef18adcca347dbfc8bdc06.dll
Size 504KB
Sample220127-b5wbnseab4
SHA256 4988437bbc5303fb773e6bb1a56b1a8f2f693a6accad0fbededd2cfb44824ad6
MD5 89b03290d8ef18adcca347dbfc8bdc06
SHA1 83eb01cc9912771a07a886385e351825d57304e5
SHA512 d699dcc2c67e3ad3b55b16e619f3ebfdaae8ea28c75ab612da9999d5701894281f7d96276f6e07ceb277e2a3053a97a18925b5b69467028900358fc1ce0e797c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3896	3824	regsvr32.exe	68
PID 3824 wrote to memory of 3896	3824	regsvr32.exe	68
PID 3824 wrote to memory of 3896	3824	regsvr32.exe	68
PID 3896 wrote to memory of 3156	3896	regsvr32.exe	69
PID 3896 wrote to memory of 3156	3896	regsvr32.exe	69
PID 3896 wrote to memory of 3156	3896	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89b03290d8ef18adcca347dbfc8bdc06.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89b03290d8ef18adcca347dbfc8bdc06.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\89b03290d8ef18adcca347dbfc8bdc06.dll",DllRegisterServer
    3⤵
    PID:3156

memory/3896-116-0x0000000004EE0000-0x0000000004F07000-memory.dmp

Download