emotet | d60c19fedd3daa149b5e017273196c098d22015df12f5fd493bf3e9713f8b668

Analysis

Target
gqxdiBj7JLMI.dll
Size 544KB
Sample220128-ws75xsadc4
SHA256 d60c19fedd3daa149b5e017273196c098d22015df12f5fd493bf3e9713f8b668
MD5 b1afca8ae246b32f781d64e9f5d5eae9
SHA1 c2d028f365c479e93d668fc154d363b5c434b714
SHA512 f27341b9ad13e431c5154788a8e658bb7cec4c9665a5b660b6834e1fce7e635f0cbf16ab2891ebb3de9c6c3de5d04dc116552e40089e95488e6c31a3dd4f2a04
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3412	1628	regsvr32.exe	68
PID 1628 wrote to memory of 3412	1628	regsvr32.exe	68
PID 1628 wrote to memory of 3412	1628	regsvr32.exe	68
PID 3412 wrote to memory of 3680	3412	regsvr32.exe	69
PID 3412 wrote to memory of 3680	3412	regsvr32.exe	69
PID 3412 wrote to memory of 3680	3412	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\gqxdiBj7JLMI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\gqxdiBj7JLMI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gqxdiBj7JLMI.dll",DllRegisterServer
    3⤵
    PID:3680

memory/3412-118-0x00000000029A0000-0x00000000029C7000-memory.dmp

Download