emotet | 8c4dfe72da192f8b23791aa58946fe56447413db63eabbc090d3704352ea0e68

Analysis

Target
cVu3dpMBAfpLTuqYZ.dll
Size 745KB
Sample211202-mg376aefbq
SHA256 8c4dfe72da192f8b23791aa58946fe56447413db63eabbc090d3704352ea0e68
MD5 36b056d7d5bcb93e29434289bb197865
SHA1 029bf7591694fc662e481c9a7a45c86c9f2a37e3
SHA512 badcfbb42bb13e66dc6667ca57e36e0ad66d9a264f11dbc428cd6f477cd9001133309c241d652e2ae23e86eaa1f198439634f285a313e04c5575df515033e1f6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4480	4348	regsvr32.exe	69
PID 4348 wrote to memory of 4480	4348	regsvr32.exe	69
PID 4348 wrote to memory of 4480	4348	regsvr32.exe	69
PID 4480 wrote to memory of 4368	4480	regsvr32.exe	70
PID 4480 wrote to memory of 4368	4480	regsvr32.exe	70
PID 4480 wrote to memory of 4368	4480	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll",DllRegisterServer
    3⤵
    PID:4368

memory/4480-119-0x0000000010000000-0x0000000010027000-memory.dmp

Download