emotet | 637f5584a53c021bb013d4f7a2c9f709ea475b2c3bc85394c91a1486b2e9c633

Analysis

Target
0e5d7e68bb1fe53c80a495ca582b88d8.dll
Size 520KB
Sample220201-2wpewachd7
SHA256 637f5584a53c021bb013d4f7a2c9f709ea475b2c3bc85394c91a1486b2e9c633
MD5 0e5d7e68bb1fe53c80a495ca582b88d8
SHA1 3582638dc1bad4671db9bf2edb36a65b76846b65
SHA512 ed808555b63b3a1ab8fccea6aa32a3e9c9dc8f72d9491c52557874f56b7427147e6029cfbbb5b830c7d693c3b4ec04914e9fe42354d6eaf428725890893fd090
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3572	2812	regsvr32.exe	53
PID 2812 wrote to memory of 3572	2812	regsvr32.exe	53
PID 2812 wrote to memory of 3572	2812	regsvr32.exe	53
PID 3572 wrote to memory of 1792	3572	regsvr32.exe	56
PID 3572 wrote to memory of 1792	3572	regsvr32.exe	56
PID 3572 wrote to memory of 1792	3572	regsvr32.exe	56

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0e5d7e68bb1fe53c80a495ca582b88d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0e5d7e68bb1fe53c80a495ca582b88d8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0e5d7e68bb1fe53c80a495ca582b88d8.dll",DllRegisterServer
    3⤵
    PID:1792

memory/3572-133-0x0000000004FA0000-0x0000000004FC6000-memory.dmp

Download