emotet | b2f9b1c04e7a853ba4040875a6bbf3e939faa44da18539325fcbd26e84bd9873

Analysis

Target
734766f0aa74ed2abc0e23e8d82c1bef.dll
Size 536KB
Sample220128-wj669shghm
SHA256 b2f9b1c04e7a853ba4040875a6bbf3e939faa44da18539325fcbd26e84bd9873
MD5 734766f0aa74ed2abc0e23e8d82c1bef
SHA1 1d85c9b2bde0868871c76e2434b86a08d5cc5fdf
SHA512 952e26585e8366025fa8775be399c7d133e71afffd987886979d293822f6132450fa3f38857fb12d5696d3b5eb011ba05cd0059eb5f61fbbc2614dc2476bb41b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1900	2496	regsvr32.exe	68
PID 2496 wrote to memory of 1900	2496	regsvr32.exe	68
PID 2496 wrote to memory of 1900	2496	regsvr32.exe	68
PID 1900 wrote to memory of 3416	1900	regsvr32.exe	69
PID 1900 wrote to memory of 3416	1900	regsvr32.exe	69
PID 1900 wrote to memory of 3416	1900	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\734766f0aa74ed2abc0e23e8d82c1bef.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\734766f0aa74ed2abc0e23e8d82c1bef.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\734766f0aa74ed2abc0e23e8d82c1bef.dll",DllRegisterServer
    3⤵
    PID:3416

memory/1900-116-0x0000000004060000-0x0000000004085000-memory.dmp

Download