emotet | 86038acc07a7861728f6c773ff716332eb2e8be44b8731987a81503c92a23d11

Analysis

Target
488008cdb335ad14b69635a46ec77b1f.dll
Size 638KB
Sample220128-kd64jaadd9
SHA256 86038acc07a7861728f6c773ff716332eb2e8be44b8731987a81503c92a23d11
MD5 488008cdb335ad14b69635a46ec77b1f
SHA1 3ea061b83e921e3db2bd985ac88e8356fe971619
SHA512 dbe2d06da0f65bde3c86694ae74f29d68aa8b20cb1df03e96d6543c86891163fe42eaab163fdee49ea4fc8680ba8361d93d53c587a9d24c4c9505123a54a04c9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1356	3776	regsvr32.exe	68
PID 3776 wrote to memory of 1356	3776	regsvr32.exe	68
PID 3776 wrote to memory of 1356	3776	regsvr32.exe	68
PID 1356 wrote to memory of 928	1356	regsvr32.exe	69
PID 1356 wrote to memory of 928	1356	regsvr32.exe	69
PID 1356 wrote to memory of 928	1356	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\488008cdb335ad14b69635a46ec77b1f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\488008cdb335ad14b69635a46ec77b1f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\488008cdb335ad14b69635a46ec77b1f.dll",DllRegisterServer
    3⤵
    PID:928

memory/1356-119-0x00000000046A0000-0x00000000046C7000-memory.dmp

Download