emotet | de4c6eb49a8f28de8997698a22465f1dec2c294470ed4915ce85b3339a52c607

Analysis

Target
Koas4G8ca1vF4YJ.dll
Size 496KB
Sample220127-lbbqaaader
SHA256 de4c6eb49a8f28de8997698a22465f1dec2c294470ed4915ce85b3339a52c607
MD5 f2d6f2669fa836a4e3ca2e5a61ac5c4b
SHA1 9199a818e8684ddd3e69a85774e50d737d546660
SHA512 5868585c5bf91b37be9816898ce25392d6dbb9e4c392322a1d20caecf2c62a13fc208a93e3e725aee3a40b8072c68f0b942a2b6fbe9db9729c012289f8efe2b3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3504	3420	regsvr32.exe	69
PID 3420 wrote to memory of 3504	3420	regsvr32.exe	69
PID 3420 wrote to memory of 3504	3420	regsvr32.exe	69
PID 3504 wrote to memory of 708	3504	regsvr32.exe	70
PID 3504 wrote to memory of 708	3504	regsvr32.exe	70
PID 3504 wrote to memory of 708	3504	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Koas4G8ca1vF4YJ.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Koas4G8ca1vF4YJ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Koas4G8ca1vF4YJ.dll",DllRegisterServer
    3⤵
    PID:708

memory/3504-116-0x00000000043C0000-0x00000000043E5000-memory.dmp

Download