emotet | 90e52cbf02dc6f103e700614c03a360258ff623aed0a559c28de3a86ced57494

Analysis

Target
VoIhlo.dll
Size 966KB
Sample220203-1q43pseber
SHA256 90e52cbf02dc6f103e700614c03a360258ff623aed0a559c28de3a86ced57494
MD5 4aa63e2b6672731a3b119aae89abd626
SHA1 1d0860ac479e73ded7d9ffbd0d9ea64fc567083a
SHA512 8bb4afda637f017636eea3f21778196be11b7071368843d234e4f67e8e6f9ce82f8a4e602644f0ba876275090df8684c1491f74a2f090e7ad76a01d8c353e9a4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1596 wrote to memory of 1636	1596	regsvr32.exe	27
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28
PID 1636 wrote to memory of 972	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\VoIhlo.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\VoIhlo.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VoIhlo.dll",DllRegisterServer
    3⤵
    PID:972

memory/1596-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1636-55-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1636-56-0x0000000000120000-0x0000000000146000-memory.dmp

Download