emotet | d3a0d8b5e8b5b5e1238f5a61463e63b9021b58ad06ec16614e89d8a5fe34abbb

Analysis

Target
vkuIT2aRjRrP4Sj.dll
Size 258KB
Sample211208-paa9xaabeq
SHA256 d3a0d8b5e8b5b5e1238f5a61463e63b9021b58ad06ec16614e89d8a5fe34abbb
MD5 513cc2139bd5118696b0fe567d6ab098
SHA1 23edcee146c33fcb91504050deabbb33e4e6bb0b
SHA512 114dcd0df2249bcd1e39200c412f0475e4b29b50fb12713040fdc960b1772e49fb605beeef60c70f0c3c689c0f227d952e1bc34919f74186d5a10226780098a2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2724	2708	regsvr32.exe	68
PID 2708 wrote to memory of 2724	2708	regsvr32.exe	68
PID 2708 wrote to memory of 2724	2708	regsvr32.exe	68
PID 2724 wrote to memory of 2288	2724	regsvr32.exe	69
PID 2724 wrote to memory of 2288	2724	regsvr32.exe	69
PID 2724 wrote to memory of 2288	2724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\vkuIT2aRjRrP4Sj.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\vkuIT2aRjRrP4Sj.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vkuIT2aRjRrP4Sj.dll",DllRegisterServer
    3⤵
    PID:2288

memory/2724-120-0x0000000010000000-0x0000000010025000-memory.dmp

Download