emotet | 79c76ca904e7a8cec304f12186d50c8e85fc463e0a5fd96aa55bd0ff152e3949

Analysis

Target
d7addc219cea45e4c158d0d5fc77bff7.dll
Size 784KB
Sample220126-lasmeabcem
SHA256 79c76ca904e7a8cec304f12186d50c8e85fc463e0a5fd96aa55bd0ff152e3949
MD5 d7addc219cea45e4c158d0d5fc77bff7
SHA1 b5d7b76cebe729588dbe07488a4e670227f584ee
SHA512 c7058efd55ef2f284e55f3ad370817dd456c3088975ed570dc92dd722b88e9378da18e64fd7c2cfab8794ffc5211d42912b6bfa485709c23fe729f03fb4e752e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2116	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2116	2700	regsvr32.exe	68
PID 2700 wrote to memory of 2116	2700	regsvr32.exe	68
PID 2116 wrote to memory of 2608	2116	regsvr32.exe	69
PID 2116 wrote to memory of 2608	2116	regsvr32.exe	69
PID 2116 wrote to memory of 2608	2116	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll",DllRegisterServer
    3⤵
    PID:2608

memory/2116-118-0x0000000003530000-0x0000000003557000-memory.dmp

Download