emotet | 3c65ae4188a5b36ac41d0ddbef708df0d445b62a182d304a7e2f081f7194e6b5

Analysis

Target
b2ff52c287292d2f104925752609135f.dll
Size 258KB
Sample211209-pk26dadcap
SHA256 3c65ae4188a5b36ac41d0ddbef708df0d445b62a182d304a7e2f081f7194e6b5
MD5 b2ff52c287292d2f104925752609135f
SHA1 05963e44e2d619da4047c3eda6683ae42f83a152
SHA512 f9673541594fe93c98698cd482ccbb17c17c28ba5080d1ef090bf65feaa1679e4a8982968f029a66d9fe66574f62ae2a1c001bbbcddf878f67e452f04cc61e52
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2796	2736	regsvr32.exe	68
PID 2736 wrote to memory of 2796	2736	regsvr32.exe	68
PID 2736 wrote to memory of 2796	2736	regsvr32.exe	68
PID 2796 wrote to memory of 4024	2796	regsvr32.exe	69
PID 2796 wrote to memory of 4024	2796	regsvr32.exe	69
PID 2796 wrote to memory of 4024	2796	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b2ff52c287292d2f104925752609135f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b2ff52c287292d2f104925752609135f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b2ff52c287292d2f104925752609135f.dll",DllRegisterServer
    3⤵
    PID:4024

memory/2796-116-0x0000000010000000-0x0000000010025000-memory.dmp

Download