emotet | a6526b4911a2ea15924d2e7dd2863a8e8fa3129ea9a6b855ee7a24d60bdfecd6

Analysis

Target
RIQBUVdBIGS.dll
Size 988KB
Sample220203-mbgf7sfdfl
SHA256 a6526b4911a2ea15924d2e7dd2863a8e8fa3129ea9a6b855ee7a24d60bdfecd6
MD5 42142f2fe95d027c5b52ea0652074df4
SHA1 bf7b71ca8ddae11ad7026411558b6dc8c0fc7bbe
SHA512 766e0b376e2ee6d30b723175b2eb5f415eb1f2e626daa4d4fadd2da54d3e84b202f6b9299308bdd89e5e5909b732f011fb2754fd85582a6d24fcf2b67de44ef0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 1476 wrote to memory of 948	1476	regsvr32.exe	27
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28
PID 948 wrote to memory of 748	948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\RIQBUVdBIGS.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\RIQBUVdBIGS.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\RIQBUVdBIGS.dll",DllRegisterServer
    3⤵
    PID:748

memory/948-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/948-56-0x00000000004C0000-0x00000000004E5000-memory.dmp

Download

memory/1476-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download