emotet | 24839b0fac85675fa68e709c2bddf8428e38ec9c1e214f88b359e409d6a76c45

Analysis

Target
846eb97e06ded44a6cc9aff89bac574a.dll
Size 629KB
Sample220128-jebhkshbdn
SHA256 24839b0fac85675fa68e709c2bddf8428e38ec9c1e214f88b359e409d6a76c45
MD5 846eb97e06ded44a6cc9aff89bac574a
SHA1 bf02ed7da89f086b62389ee2d2d7ae009854fae3
SHA512 6b32e9781764be7c591fe58c2dcbcbe1f2ccd6a2a429373f5a67c65417970a2bb864ab25d6078fe7d8e943688ec0410615c30212dd24de70fcedbcfd7626565a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3620	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3620	3716	regsvr32.exe	68
PID 3716 wrote to memory of 3620	3716	regsvr32.exe	68
PID 3620 wrote to memory of 4100	3620	regsvr32.exe	69
PID 3620 wrote to memory of 4100	3620	regsvr32.exe	69
PID 3620 wrote to memory of 4100	3620	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\846eb97e06ded44a6cc9aff89bac574a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\846eb97e06ded44a6cc9aff89bac574a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\846eb97e06ded44a6cc9aff89bac574a.dll",DllRegisterServer
    3⤵
    PID:4100

memory/3620-116-0x0000000000E20000-0x0000000000E45000-memory.dmp

Download