emotet | 4dc62703ebee2e6c7b96283da72fa2ede35bffc9534d44d0aad42810705fdcdb

Analysis

Target
2d026ab89622bd895816d27e5235c303.dll
Size 367KB
Sample220520-larecahff3
SHA256 4dc62703ebee2e6c7b96283da72fa2ede35bffc9534d44d0aad42810705fdcdb
MD5 2d026ab89622bd895816d27e5235c303
SHA1 ed751a7620ef8959ce817d4b94885c87b0651a75
SHA512 4f2b073753a691ed13f60a86f37a2d48a8f3f5c2d0b3b121f4edd08f934a52b31056e434f625a7d26dc2e3d156f7bf1b6630e190e3fd5427dc69fa81a579987d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
304	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 560	304	regsvr32.exe	26
PID 304 wrote to memory of 560	304	regsvr32.exe	26
PID 304 wrote to memory of 560	304	regsvr32.exe	26
PID 304 wrote to memory of 560	304	regsvr32.exe	26
PID 304 wrote to memory of 560	304	regsvr32.exe	26

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d026ab89622bd895816d27e5235c303.dll
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JYfoDzTld\rEgoSuaijFkYg.dll"
  2⤵
  PID:560

memory/304-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Download

memory/304-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download