emotet | 7a29ce889f3dca5f14bafc7a1d1f604bb80f092bfecb190ffaf8c58ccfd009b1

Analysis

Target
9e436f07bc3f29e341ad97bd1b23b108.dll
Size 1.0MB
Sample211208-ym477aadgp
SHA256 7a29ce889f3dca5f14bafc7a1d1f604bb80f092bfecb190ffaf8c58ccfd009b1
MD5 9e436f07bc3f29e341ad97bd1b23b108
SHA1 74b1ad3034dd4e6532d4c1f9f7f7f14c2e89b542
SHA512 0917dfcdf2ac378f94f2497db5d12d0d895863102bf711d1b0c665133464c883d45b32e83006e4aed3154754519ff50d8280fc24af8915855d052315e6049430
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 3728	3652	regsvr32.exe	68
PID 3652 wrote to memory of 3728	3652	regsvr32.exe	68
PID 3652 wrote to memory of 3728	3652	regsvr32.exe	68
PID 3728 wrote to memory of 652	3728	regsvr32.exe	69
PID 3728 wrote to memory of 652	3728	regsvr32.exe	69
PID 3728 wrote to memory of 652	3728	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll",DllRegisterServer
    3⤵
    PID:652

memory/3728-117-0x0000000010000000-0x0000000010027000-memory.dmp

Download