emotet | fc9b10bfcd65aa226ffaf685cfa3abb13d58aec3c59e058af348965bbea405bc

Analysis

Target
DkrA1a5EPVdteh9vQrcNF.dll
Size 367KB
Sample220520-fs459sbbg9
SHA256 fc9b10bfcd65aa226ffaf685cfa3abb13d58aec3c59e058af348965bbea405bc
MD5 577e513a1185f4672f69bae715c9e457
SHA1 5fed75569d48ba7f9741e56a1acf6f2d61167282
SHA512 1ef538d2e1645eaab18c9877ad601023a3946d2b9b54248248be47440b4031996e6c96f500dfdb8f5c50ffc268c8780cff78b053217595b3e16836c3045c1745
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1076	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 832	1076	regsvr32.exe	27
PID 1076 wrote to memory of 832	1076	regsvr32.exe	27
PID 1076 wrote to memory of 832	1076	regsvr32.exe	27
PID 1076 wrote to memory of 832	1076	regsvr32.exe	27
PID 1076 wrote to memory of 832	1076	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DkrA1a5EPVdteh9vQrcNF.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NIstomkGfeDy\myQwKtTmgNgD.dll"
  2⤵
  PID:832

memory/1076-54-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Download

memory/1076-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download