emotet | 5eb32c98855e4234bb81de2e1d90f54ce5b55fba4ed4385db1d80d2a2736fce8

Analysis

Target
e7f27ea66f1de5ba839aa8794baad656.dll
Size 252KB
Sample220202-m7zyeshger
SHA256 5eb32c98855e4234bb81de2e1d90f54ce5b55fba4ed4385db1d80d2a2736fce8
MD5 e7f27ea66f1de5ba839aa8794baad656
SHA1 eb482b8acd05d37d024e941a6cd2e4e4214f20e3
SHA512 0f3d20a062eee256bc169580c190b409ffe526c4458469fc154154055ffb8e7e42f3c5b405c2607c8aff5dbe6794690435666f22dcacf5cb18da7cf2cfa45ee5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 544	3172	regsvr32.exe	55
PID 3172 wrote to memory of 544	3172	regsvr32.exe	55
PID 3172 wrote to memory of 544	3172	regsvr32.exe	55
PID 544 wrote to memory of 2760	544	regsvr32.exe	58
PID 544 wrote to memory of 2760	544	regsvr32.exe	58
PID 544 wrote to memory of 2760	544	regsvr32.exe	58

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e7f27ea66f1de5ba839aa8794baad656.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e7f27ea66f1de5ba839aa8794baad656.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e7f27ea66f1de5ba839aa8794baad656.dll",DllRegisterServer
    3⤵
    PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:1728

memory/544-130-0x0000000010000000-0x0000000010025000-memory.dmp

Download