emotet | a6cefe2b895d668adf8327fd1ae3d50eb135c7abb247e6e48a14dfbbca52862f

Analysis

Target
F0Vp8hugsh.dll
Size 705KB
Sample220126-v27ebafghj
SHA256 a6cefe2b895d668adf8327fd1ae3d50eb135c7abb247e6e48a14dfbbca52862f
MD5 fe9e31c9866ce3957f16400adeabd932
SHA1 608d35b874b1cc874b98096e77e48453814f2d87
SHA512 62eb8562e6591acf27e53177e21bb0002f0698f88e196128f02a337ffae00739e9fa4c07e6b17104ffc3079aaa5b06ffc5c923e496fe2f8e5e34872f3cf78e03
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3724	2704	regsvr32.exe	68
PID 2704 wrote to memory of 3724	2704	regsvr32.exe	68
PID 2704 wrote to memory of 3724	2704	regsvr32.exe	68
PID 3724 wrote to memory of 2608	3724	regsvr32.exe	69
PID 3724 wrote to memory of 2608	3724	regsvr32.exe	69
PID 3724 wrote to memory of 2608	3724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\F0Vp8hugsh.dll",DllRegisterServer
    3⤵
    PID:2608

memory/3724-117-0x0000000002CE0000-0x0000000002D05000-memory.dmp

Download