emotet | 253d80ef0845b87680caf4da3a2053180fdab960d8d27415db3d1f6b8f1ad415

Analysis

Target
da4251601546daf6a4f83140041dae2b.dll
Size 512KB
Sample220127-ss397aehbk
SHA256 253d80ef0845b87680caf4da3a2053180fdab960d8d27415db3d1f6b8f1ad415
MD5 da4251601546daf6a4f83140041dae2b
SHA1 cf134fbe417ab2169d83eefa0441ab10f4796600
SHA512 f43801199517f91236bf78b5ba474706731f603ec2aa569a83e0869fb322a0bacfb4204b22677beb34c0fd6e101fe500f24dd6e333e4d83b4e8a783f43e49a30
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2352	4052	regsvr32.exe	69
PID 4052 wrote to memory of 2352	4052	regsvr32.exe	69
PID 4052 wrote to memory of 2352	4052	regsvr32.exe	69
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	70
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	70
PID 2352 wrote to memory of 2220	2352	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll",DllRegisterServer
    3⤵
    PID:2220

memory/2352-118-0x0000000000340000-0x0000000000365000-memory.dmp

Download