emotet | f1e34014f42b3e55035e60d9ca98a62da034f71ee491a5f6af92c7c33065550b

Analysis

Target
c53f107e32e923bae19131a5622a96df.dll
Size 258KB
Sample211209-cf5pgsbhen
SHA256 f1e34014f42b3e55035e60d9ca98a62da034f71ee491a5f6af92c7c33065550b
MD5 c53f107e32e923bae19131a5622a96df
SHA1 a380551069df81a7c5ca96668f8e7bca19d94cf4
SHA512 a28e36bec1c4d48da3df0f3e4880ea0c5f13636c98cee1eb3e2c3d8599b41baf0058c2c1213f1e89de7954dc4aad9e0bdac9ba2bd6cbb9bcf0468c7a4e3bc4e3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2404	2104	regsvr32.exe	68
PID 2104 wrote to memory of 2404	2104	regsvr32.exe	68
PID 2104 wrote to memory of 2404	2104	regsvr32.exe	68
PID 2404 wrote to memory of 2656	2404	regsvr32.exe	69
PID 2404 wrote to memory of 2656	2404	regsvr32.exe	69
PID 2404 wrote to memory of 2656	2404	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll",DllRegisterServer
    3⤵
    PID:2656

memory/2404-116-0x0000000010000000-0x0000000010025000-memory.dmp

Download