emotet | 0667fabc99dcc6f28aeb03f2e50c80c22312d645fdb593e8be97748d30859243

Analysis

Target
r2J9jEpSzDLpV.dll
Size 784KB
Sample220126-yleadaaad8
SHA256 0667fabc99dcc6f28aeb03f2e50c80c22312d645fdb593e8be97748d30859243
MD5 3ad36fdcd52e0bf8060501f4b92b05f9
SHA1 1dfa8c003a405ed579c049e5352cb81a8b832fd8
SHA512 fac0368d81d73ef555140a32e0fa914ab0599dea79c26f3a56643f1e559a0c6427e79000e8371a56aab583147d0baa9b456eea038635784f6c839d86ae2dc96d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2676 wrote to memory of 3812	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3812	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3812	2676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll",DllRegisterServer
    3⤵
    PID:3812

memory/2676-117-0x0000000000790000-0x00000000007B7000-memory.dmp

Download