emotet | 43c79d4140dfcbf89a5f7e93509075860ffe8ec4cf4f6c612f5ee9d26b5fd8ac

Analysis

Target
sRrjueeC9e.dll
Size 258KB
Sample211208-p476qsadek
SHA256 43c79d4140dfcbf89a5f7e93509075860ffe8ec4cf4f6c612f5ee9d26b5fd8ac
MD5 f330b42efef5b43fbed7f3b68c3ce183
SHA1 114655fb7bba9aef254b788cb63720c7a9cd63a8
SHA512 04948e8faafac09f2ef908c9f7fdb30633d3cdef78b140d017756e89a0facc055478624173616d52171bde9cb2a87ce3bc7b3df195c013a82d2b8ed0eab40ed8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3780	3924	regsvr32.exe	68
PID 3924 wrote to memory of 3780	3924	regsvr32.exe	68
PID 3924 wrote to memory of 3780	3924	regsvr32.exe	68
PID 3780 wrote to memory of 3512	3780	regsvr32.exe	69
PID 3780 wrote to memory of 3512	3780	regsvr32.exe	69
PID 3780 wrote to memory of 3512	3780	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\sRrjueeC9e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\sRrjueeC9e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sRrjueeC9e.dll",DllRegisterServer
    3⤵
    PID:3512

memory/3780-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download