emotet | b8d3085868a57d531bcb5cffcc99d8815c98134c181db3666730203fef012df5

Analysis

Target
2v649dzEDi.dll
Size 536KB
Sample220128-w6mfdaage3
SHA256 b8d3085868a57d531bcb5cffcc99d8815c98134c181db3666730203fef012df5
MD5 30ad5305cf732350ec3fd27b39314a81
SHA1 c865d99ea1b5b7a835a303eff2b6f4ef468d9e82
SHA512 ae0d9dd43029732274bbd741379d93540ef8dbc09205393024f91f11adf34f4f804da71ea3b2a9d4d5c7446e1b586763f7ecec73b9a1b4897e13958cd4358947
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3056	2768	regsvr32.exe	68
PID 2768 wrote to memory of 3056	2768	regsvr32.exe	68
PID 2768 wrote to memory of 3056	2768	regsvr32.exe	68
PID 3056 wrote to memory of 3684	3056	regsvr32.exe	69
PID 3056 wrote to memory of 3684	3056	regsvr32.exe	69
PID 3056 wrote to memory of 3684	3056	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll",DllRegisterServer
    3⤵
    PID:3684

memory/3056-116-0x0000000004C60000-0x0000000004C85000-memory.dmp

Download