emotet | 0611448f770b80b0e753530f031884f40b884fc7eef909707af91fade2147bbb

Analysis

Target
239de376d1c934ec43873863d91b1477.dll
Size 602KB
Sample220119-z7bl2sddc8
SHA256 0611448f770b80b0e753530f031884f40b884fc7eef909707af91fade2147bbb
MD5 239de376d1c934ec43873863d91b1477
SHA1 81da4867a1597c34b0b492985b4ebf8864409f84
SHA512 3d70529e9816785406ffab98f75bfbe5d258d85c901051fdcc0bf94aee0ba537553f665bc76eff193bb4999bdd47ce188202657eb7fd8a9f5d3867d71585e859
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3392	2980	regsvr32.exe	52
PID 2980 wrote to memory of 3392	2980	regsvr32.exe	52
PID 2980 wrote to memory of 3392	2980	regsvr32.exe	52
PID 3392 wrote to memory of 3260	3392	regsvr32.exe	53
PID 3392 wrote to memory of 3260	3392	regsvr32.exe	53
PID 3392 wrote to memory of 3260	3392	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll",DllRegisterServer
    3⤵
    PID:3260

memory/3392-130-0x0000000004130000-0x0000000004158000-memory.dmp

Download