emotet | 581867969f3f616f6e2c8aeca27b73db4228e100473b8a07d4d1efc6c0daca3a

Analysis

Target
9a0c1f23ab0188793eca6c6f1aa9d265.dll
Size 536KB
Sample220128-wj669shggr
SHA256 581867969f3f616f6e2c8aeca27b73db4228e100473b8a07d4d1efc6c0daca3a
MD5 9a0c1f23ab0188793eca6c6f1aa9d265
SHA1 5b2147e679489be1eb8489b532181a19a37f48e1
SHA512 a4f8c4ca889dad0db420e2349a5d90791e08e7d28dc754335f1863407455cc931855b2e404ce60af001c50b13ba65486275751f7e3054658e5e0b23f7540e5b0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 668	3432	regsvr32.exe	69
PID 3432 wrote to memory of 668	3432	regsvr32.exe	69
PID 3432 wrote to memory of 668	3432	regsvr32.exe	69
PID 668 wrote to memory of 3188	668	regsvr32.exe	70
PID 668 wrote to memory of 3188	668	regsvr32.exe	70
PID 668 wrote to memory of 3188	668	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a0c1f23ab0188793eca6c6f1aa9d265.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a0c1f23ab0188793eca6c6f1aa9d265.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9a0c1f23ab0188793eca6c6f1aa9d265.dll",DllRegisterServer
    3⤵
    PID:3188

memory/668-115-0x00000000041B0000-0x00000000041D5000-memory.dmp

Download