emotet | 3941d3a7db43557f478efee994cb79aa78453fa5a62b845d0c76dc1ab95aa48f

Analysis

Target
76167fd34b96bf58b70fd009928c097f.dll
Size 705KB
Sample220126-rraqtadgbn
SHA256 3941d3a7db43557f478efee994cb79aa78453fa5a62b845d0c76dc1ab95aa48f
MD5 76167fd34b96bf58b70fd009928c097f
SHA1 c63b5d4293ed513a2ffd944133b7898c10d2ef11
SHA512 bd9593bcaf2227f0a9b1530758e63b321c97c2159ad31a7d29edf713c886a52cd39732a9a7dac00559603228a53166070f83f71575ac811a6e55c1b3dfecaa48
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2428	2188	regsvr32.exe	68
PID 2188 wrote to memory of 2428	2188	regsvr32.exe	68
PID 2188 wrote to memory of 2428	2188	regsvr32.exe	68
PID 2428 wrote to memory of 2768	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2768	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2768	2428	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\76167fd34b96bf58b70fd009928c097f.dll",DllRegisterServer
    3⤵
    PID:2768

memory/2428-115-0x0000000004D30000-0x0000000004D55000-memory.dmp

Download