emotet | 0c7a047e5f486b89b21ea881396be822a9e2b5a25a0d8a3adaeeba9eb383442c

Analysis

Target
794acf35d4123425b015d0570a0bf209.dll
Size 596KB
Sample220307-a6ymraaceq
SHA256 0c7a047e5f486b89b21ea881396be822a9e2b5a25a0d8a3adaeeba9eb383442c
MD5 794acf35d4123425b015d0570a0bf209
SHA1 02f7828911d4add2702c9ba4749b2ad02198cc1c
SHA512 398f516ec471d2c2ae76bc7e5e8616a01394a364d130e86d870b1ea7d00fc08ba334b913e415af3185ad5125ec21eb2e313724940a593394a1356fbd407879c6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1612	1488	regsvr32.exe	80
PID 1488 wrote to memory of 1612	1488	regsvr32.exe	80
PID 1488 wrote to memory of 1612	1488	regsvr32.exe	80
PID 1612 wrote to memory of 2252	1612	regsvr32.exe	81
PID 1612 wrote to memory of 2252	1612	regsvr32.exe	81
PID 1612 wrote to memory of 2252	1612	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\794acf35d4123425b015d0570a0bf209.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\794acf35d4123425b015d0570a0bf209.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\794acf35d4123425b015d0570a0bf209.dll",DllRegisterServer
    3⤵
    PID:2252

memory/1612-131-0x0000000002CF0000-0x0000000002D17000-memory.dmp

Download