emotet | 94520e6972658c507c83b862c042eb47e96ec5a6e83dcd74e7e3e60348af98c3

Analysis

Target
otHeGyx7NuSb.dll
Size 258KB
Sample211208-qf3rsaaecp
SHA256 94520e6972658c507c83b862c042eb47e96ec5a6e83dcd74e7e3e60348af98c3
MD5 46eb5183c6118d317b50361f38bf9962
SHA1 fba4b3e59609e10f2b40d22bdb0651ee53d13dbf
SHA512 3986a241bd4dafb4ea8ad64f0aec5a8d09b86a690a5f0559b695667ccf735fe624068f393eaabb553a673b8b230d71c580b6cfb509f18ebf49d400f1c41c4df6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 3704	4216	regsvr32.exe	69
PID 4216 wrote to memory of 3704	4216	regsvr32.exe	69
PID 4216 wrote to memory of 3704	4216	regsvr32.exe	69
PID 3704 wrote to memory of 416	3704	regsvr32.exe	70
PID 3704 wrote to memory of 416	3704	regsvr32.exe	70
PID 3704 wrote to memory of 416	3704	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\otHeGyx7NuSb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\otHeGyx7NuSb.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\otHeGyx7NuSb.dll",DllRegisterServer
    3⤵
    PID:416

memory/3704-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download