emotet | 9f1004bbed74c61471cfcc5590cc4064fd50c9cf4b96395e2e254e26b20db558

Analysis

Target
3090de9e0581ffea5d75c390cb8104a2.dll
Size 784KB
Sample220126-wlb4xagff5
SHA256 9f1004bbed74c61471cfcc5590cc4064fd50c9cf4b96395e2e254e26b20db558
MD5 3090de9e0581ffea5d75c390cb8104a2
SHA1 8e60767552648fce49ef3c18ccf44e142d20d1a4
SHA512 8ff2783a65e59d57473e7abda7a5c6afd309c6477cc68e13f020934964bbbff2ce45ed649320ed19a836041427094eb072f314a1786c5b8631efe26480616dbd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 3000	2736	regsvr32.exe	68
PID 2736 wrote to memory of 3000	2736	regsvr32.exe	68
PID 2736 wrote to memory of 3000	2736	regsvr32.exe	68
PID 3000 wrote to memory of 2200	3000	regsvr32.exe	69
PID 3000 wrote to memory of 2200	3000	regsvr32.exe	69
PID 3000 wrote to memory of 2200	3000	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3090de9e0581ffea5d75c390cb8104a2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3090de9e0581ffea5d75c390cb8104a2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3090de9e0581ffea5d75c390cb8104a2.dll",DllRegisterServer
    3⤵
    PID:2200

memory/3000-118-0x0000000000D80000-0x0000000000DA7000-memory.dmp

Download