emotet | 325d29ab61a19e2906948e76dc7e43b6307df34165d6a86ebbc960563d37d0ce

Analysis

Target
366af6454924b2e4c91bb6d1a8ae23ab.dll
Size 536KB
Sample220128-wjk9sshgfm
SHA256 325d29ab61a19e2906948e76dc7e43b6307df34165d6a86ebbc960563d37d0ce
MD5 366af6454924b2e4c91bb6d1a8ae23ab
SHA1 16c844c96508859dccc1625388779d79eb05c544
SHA512 828b67da57993a382d0d792c53319ce398a5c59c5bb59bad3f818815cb811e92ad8aa572f29ef9b86264f4cfab34188fa36352647e5c7fe6397349fc5534bce9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 4092	3992	regsvr32.exe	69
PID 3992 wrote to memory of 4092	3992	regsvr32.exe	69
PID 3992 wrote to memory of 4092	3992	regsvr32.exe	69
PID 4092 wrote to memory of 4596	4092	regsvr32.exe	70
PID 4092 wrote to memory of 4596	4092	regsvr32.exe	70
PID 4092 wrote to memory of 4596	4092	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll",DllRegisterServer
    3⤵
    PID:4596

memory/4092-115-0x00000000044E0000-0x0000000004505000-memory.dmp

Download