emotet | 4202fa3bfbee80195a1616eab54a504d1e4eae4712e37e381583a251d745127e

Analysis

Target
439fc5c0f7743e01f93bf56098c33b11.dll
Size 780KB
Sample220124-2m8r6abfck
SHA256 4202fa3bfbee80195a1616eab54a504d1e4eae4712e37e381583a251d745127e
MD5 439fc5c0f7743e01f93bf56098c33b11
SHA1 b16a409386c37045e2b72764530a916a8db3950f
SHA512 90eaf17a3736fd2fdb9545d3b30ad3bd44debeb41dc4b8c31185449275236270aa6256dd8cbdd72d1a1ead878c10c611f3af35fda5cf09320861f5196b3cd902
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1284	3112	regsvr32.exe	69
PID 3112 wrote to memory of 1284	3112	regsvr32.exe	69
PID 3112 wrote to memory of 1284	3112	regsvr32.exe	69
PID 1284 wrote to memory of 2208	1284	regsvr32.exe	70
PID 1284 wrote to memory of 2208	1284	regsvr32.exe	70
PID 1284 wrote to memory of 2208	1284	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\439fc5c0f7743e01f93bf56098c33b11.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\439fc5c0f7743e01f93bf56098c33b11.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\439fc5c0f7743e01f93bf56098c33b11.dll",DllRegisterServer
    3⤵
    PID:2208

memory/1284-119-0x0000000004160000-0x0000000004185000-memory.dmp

Download