emotet | 00b19c731501a54871db175d16748d1b9eb17d2b409a2c8496862c8dcdb164e5

Analysis

Target
mcGXmVoO4U2A.dll
Size 745KB
Sample211202-v9flkaahdk
SHA256 00b19c731501a54871db175d16748d1b9eb17d2b409a2c8496862c8dcdb164e5
MD5 02d2a72643c3c7e838aca4ab3ff1b851
SHA1 cef56b7986e06029e2ad78165da6159cd4de2f22
SHA512 14d81bb9c405d02e1c54b5315524229ce7767c993ad59a1b5f457a1ab0752834b39013fe4ff30a2cb48bdfa78b0d851e85d514eba30074f0fed2b6d5f8ad352c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3356	3724	regsvr32.exe	68
PID 3724 wrote to memory of 3356	3724	regsvr32.exe	68
PID 3724 wrote to memory of 3356	3724	regsvr32.exe	68
PID 3356 wrote to memory of 2116	3356	regsvr32.exe	69
PID 3356 wrote to memory of 2116	3356	regsvr32.exe	69
PID 3356 wrote to memory of 2116	3356	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\mcGXmVoO4U2A.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\mcGXmVoO4U2A.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\mcGXmVoO4U2A.dll",DllRegisterServer
    3⤵
    PID:2116

memory/3356-119-0x0000000010000000-0x0000000010027000-memory.dmp

Download