emotet | 75aea4f82c38adcb2578c47bb68e4b5181da35a4b12fc0e12ce6977db0052ffe

Analysis

Target
5R5Dz9UhFae3QqksIqR.dll
Size 544KB
Sample220128-ws7t6aaahm
SHA256 75aea4f82c38adcb2578c47bb68e4b5181da35a4b12fc0e12ce6977db0052ffe
MD5 c95444a688555bb815e55b2f5a7900a3
SHA1 933769c70418199110716ed9a58eab259565eac0
SHA512 3801c21c0e9b3a18897e4246d98d609cef39d8864ab78feaecfe3fbf65ff12cc240b1b2987a4285a1b39967c6e66bbf13f49b01081d495f80fc3acdee41aff1c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2748	2708	regsvr32.exe	68
PID 2708 wrote to memory of 2748	2708	regsvr32.exe	68
PID 2708 wrote to memory of 2748	2708	regsvr32.exe	68
PID 2748 wrote to memory of 3636	2748	regsvr32.exe	69
PID 2748 wrote to memory of 3636	2748	regsvr32.exe	69
PID 2748 wrote to memory of 3636	2748	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5R5Dz9UhFae3QqksIqR.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5R5Dz9UhFae3QqksIqR.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5R5Dz9UhFae3QqksIqR.dll",DllRegisterServer
    3⤵
    PID:3636

memory/2748-115-0x00000000010B0000-0x00000000010D7000-memory.dmp

Download