emotet | 87b94bc39a24a52fea2b0a9a3fbfbbb5ce88e909265faed208a79947151ee310

Analysis

Target
914b841aeedde6116686a4869e940d09.dll
Size 620KB
Sample220121-nnapvshafn
SHA256 87b94bc39a24a52fea2b0a9a3fbfbbb5ce88e909265faed208a79947151ee310
MD5 914b841aeedde6116686a4869e940d09
SHA1 7eaa5e56c97462ba6ca031004bdbc123c9e36c15
SHA512 6973a47130a6a2623828383a5ee0f7d1e66ea31a621e4ceee6963dc5c8f2dd17f82b3bb525e73ed081c92e74fa81ddf74f43ff41112b35e7a692688c3e03ff74
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2832	3828	regsvr32.exe	68
PID 3828 wrote to memory of 2832	3828	regsvr32.exe	68
PID 3828 wrote to memory of 2832	3828	regsvr32.exe	68
PID 2832 wrote to memory of 3044	2832	regsvr32.exe	69
PID 2832 wrote to memory of 3044	2832	regsvr32.exe	69
PID 2832 wrote to memory of 3044	2832	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\914b841aeedde6116686a4869e940d09.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\914b841aeedde6116686a4869e940d09.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\914b841aeedde6116686a4869e940d09.dll",DllRegisterServer
    3⤵
    PID:3044

memory/2832-116-0x0000000000C40000-0x0000000000C68000-memory.dmp

Download