emotet | 5cf8cde069564b44b45d2524e0f0d95ff2ed508c910d361c1ac33bca1dc9221b

Analysis

Target
ECdFfVheOsAc.dll
Size 496KB
Sample220127-khnsraacb4
SHA256 5cf8cde069564b44b45d2524e0f0d95ff2ed508c910d361c1ac33bca1dc9221b
MD5 4887d560407e6e176843837041b2b9fb
SHA1 16688332b83552b8c29ed067cebc5a79496d139a
SHA512 1d16d4a6248ce5ad61bc51d6410eddce41e1c9637a6b3968e6240cd8a9457d8852f2bf212a3e3a9c9ae32a80ecbc289a870ea06238fa8c5d9c0ae88eba78a52d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2584	2480	regsvr32.exe	68
PID 2480 wrote to memory of 2584	2480	regsvr32.exe	68
PID 2480 wrote to memory of 2584	2480	regsvr32.exe	68
PID 2584 wrote to memory of 3492	2584	regsvr32.exe	69
PID 2584 wrote to memory of 3492	2584	regsvr32.exe	69
PID 2584 wrote to memory of 3492	2584	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ECdFfVheOsAc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ECdFfVheOsAc.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ECdFfVheOsAc.dll",DllRegisterServer
    3⤵
    PID:3492

memory/2584-118-0x0000000002710000-0x0000000002735000-memory.dmp

Download