emotet | 15d22fbff8df1be5e375f8fabb0ff6a2f9e809ddee8d892957adc06e65fe9d67

Analysis

Target
ed0689d2104474db330ceebad75892ed.dll
Size 784KB
Sample220126-m72f9acafr
SHA256 15d22fbff8df1be5e375f8fabb0ff6a2f9e809ddee8d892957adc06e65fe9d67
MD5 ed0689d2104474db330ceebad75892ed
SHA1 4ea2dab903b64b8ae231dcaa855d1b11fcc432b4
SHA512 7297910566c5aac30a9e7af7a07e9de79516618b895debb5883c324b81c93c22f442c746eb639ac41ce07055e7a5707f54a6868f16e98b74551c432f1c1b27e0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2256	2712	regsvr32.exe	69
PID 2712 wrote to memory of 2256	2712	regsvr32.exe	69
PID 2712 wrote to memory of 2256	2712	regsvr32.exe	69
PID 2256 wrote to memory of 3056	2256	regsvr32.exe	70
PID 2256 wrote to memory of 3056	2256	regsvr32.exe	70
PID 2256 wrote to memory of 3056	2256	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ed0689d2104474db330ceebad75892ed.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ed0689d2104474db330ceebad75892ed.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ed0689d2104474db330ceebad75892ed.dll",DllRegisterServer
    3⤵
    PID:3056

memory/2256-115-0x00000000040E0000-0x0000000004107000-memory.dmp

Download