emotet | c244cd8dc0ae29d72229d3a0ddad747a22a9be7dda2b02462f33147a3d12ee1b

Analysis

Target
72b82e360bbb5c22f9c60464b4359061.dll
Size 784KB
Sample220126-vxkprafgcp
SHA256 c244cd8dc0ae29d72229d3a0ddad747a22a9be7dda2b02462f33147a3d12ee1b
MD5 72b82e360bbb5c22f9c60464b4359061
SHA1 2964b0e3f18ebfc4ba2113d1b60e70f7d930b245
SHA512 eaa7b0f0856b692fb4957d8bc5a49189d56e6469825160e8f64f8db83ffadd1315423628051f1e66646baaf88eed2bfa6d879508894b653c5c2e9cc870614399
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2708	2640	regsvr32.exe	68
PID 2640 wrote to memory of 2708	2640	regsvr32.exe	68
PID 2640 wrote to memory of 2708	2640	regsvr32.exe	68
PID 2708 wrote to memory of 3852	2708	regsvr32.exe	69
PID 2708 wrote to memory of 3852	2708	regsvr32.exe	69
PID 2708 wrote to memory of 3852	2708	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\72b82e360bbb5c22f9c60464b4359061.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\72b82e360bbb5c22f9c60464b4359061.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\72b82e360bbb5c22f9c60464b4359061.dll",DllRegisterServer
    3⤵
    PID:3852

memory/2708-118-0x0000000000C00000-0x0000000000C27000-memory.dmp

Download