emotet | 83fc91e748906a49deaaa4ae74141cb00da18bf2d7c8778b715601e819aea9ad

Analysis

Target
eP8PJPKzOGn1.dll
Size 544KB
Sample220128-wj669sabb8
SHA256 83fc91e748906a49deaaa4ae74141cb00da18bf2d7c8778b715601e819aea9ad
MD5 3c791fef6b854006a1eb248982c4a4c8
SHA1 8cd411a4e45445d1b6e4ee3aab6ca1910d5efd18
SHA512 d9db14a8dadf9a18ebb92afb076f3cdb7add556d2825e611169b1fad85835d5b1742933a0366ace20bb0cb7247ae791c004a2b064262bd68638110a1e5f90894
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3052	2748	regsvr32.exe	68
PID 2748 wrote to memory of 3052	2748	regsvr32.exe	68
PID 2748 wrote to memory of 3052	2748	regsvr32.exe	68
PID 3052 wrote to memory of 2676	3052	regsvr32.exe	69
PID 3052 wrote to memory of 2676	3052	regsvr32.exe	69
PID 3052 wrote to memory of 2676	3052	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\eP8PJPKzOGn1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\eP8PJPKzOGn1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\eP8PJPKzOGn1.dll",DllRegisterServer
    3⤵
    PID:2676

memory/3052-118-0x0000000004CB0000-0x0000000004CD7000-memory.dmp

Download