emotet | fe8679050583b9705d4e79627b5e98f8e2c6dc8bddcef80f2405378a068631ac

Analysis

Target
2Adw5YTHtYPFHHf4YHSs3KKNlSwgmyV.dll
Size 367KB
Sample220520-gva6msdda3
SHA256 fe8679050583b9705d4e79627b5e98f8e2c6dc8bddcef80f2405378a068631ac
MD5 0868ceac8f9c9c143e194b78ad2aaa87
SHA1 7f48dfc79071d151c07361d44c762f6f8c2f1e66
SHA512 ad19229e4c9293b8bf2beec9544aea8c79f7ef98ed2909250e59ee2a88fd82ce1c8c091fd1f111e7ea4a0866c94a44d6bd1d7adf66b486b54532a2f18d220bdd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1900	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 832	1900	regsvr32.exe	27
PID 1900 wrote to memory of 832	1900	regsvr32.exe	27
PID 1900 wrote to memory of 832	1900	regsvr32.exe	27
PID 1900 wrote to memory of 832	1900	regsvr32.exe	27
PID 1900 wrote to memory of 832	1900	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2Adw5YTHtYPFHHf4YHSs3KKNlSwgmyV.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZuPuLQauJEgc\RluwjEfrGQ.dll"
  2⤵
  PID:832

memory/1900-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1900-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download