emotet | e40fc89879abb84f00f87d849237d92b8994b849e45cc637420bfa33bbc5c002

Analysis

Target
rIp53dLtFbXTa5PN.dll
Size 536KB
Sample220128-ws75xsadc6
SHA256 e40fc89879abb84f00f87d849237d92b8994b849e45cc637420bfa33bbc5c002
MD5 aa8aafe150a51ba0bb8b2eeee0071f2d
SHA1 e9ea712df0098e406578b247be50d8069a2e7979
SHA512 9dd2709c9a6a16a4b562524506fb19e5eb8832f0ec54c50e5a6def14b74269ef84f237eb41cfae361055327e6bdf6c7e185d92171fca91522ca309c7c27f23ba
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 388	2700	regsvr32.exe	68
PID 2700 wrote to memory of 388	2700	regsvr32.exe	68
PID 2700 wrote to memory of 388	2700	regsvr32.exe	68
PID 388 wrote to memory of 3664	388	regsvr32.exe	69
PID 388 wrote to memory of 3664	388	regsvr32.exe	69
PID 388 wrote to memory of 3664	388	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\rIp53dLtFbXTa5PN.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\rIp53dLtFbXTa5PN.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\rIp53dLtFbXTa5PN.dll",DllRegisterServer
    3⤵
    PID:3664

memory/388-118-0x00000000049E0000-0x0000000004A05000-memory.dmp

Download