emotet | 00fb6971817095603fc969736e9ea7ca1e2783bae2c0ca896b74065f6eea718a

Analysis

Target
a756b033477e98d537ece195ffb4cd8b.dll
Size 258KB
Sample211209-pll6jsdcbj
SHA256 00fb6971817095603fc969736e9ea7ca1e2783bae2c0ca896b74065f6eea718a
MD5 a756b033477e98d537ece195ffb4cd8b
SHA1 09da684da99ec0de6bd03462098a87ab7dd0dc45
SHA512 0b0bb86452a4d3e486dc25c2975a080756d2d0f2cafe19c9901b97a3cd49d2a530c987183bf92acf047d24724d79a37cafdd66eff303be2616f848533250f76b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2636	2512	regsvr32.exe	68
PID 2512 wrote to memory of 2636	2512	regsvr32.exe	68
PID 2512 wrote to memory of 2636	2512	regsvr32.exe	68
PID 2636 wrote to memory of 3156	2636	regsvr32.exe	69
PID 2636 wrote to memory of 3156	2636	regsvr32.exe	69
PID 2636 wrote to memory of 3156	2636	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll",DllRegisterServer
    3⤵
    PID:3156

memory/2636-117-0x0000000010000000-0x0000000010025000-memory.dmp

Download