emotet | 0bc386bed2a61a9d2ff8f657a30e6e1f09fe28b5ea25e93c16ce6c516d9df860

Analysis

Target
9a3a6a149d7c4126d6924f32c1338100.dll
Size 496KB
Sample220127-b5v1xadffq
SHA256 0bc386bed2a61a9d2ff8f657a30e6e1f09fe28b5ea25e93c16ce6c516d9df860
MD5 9a3a6a149d7c4126d6924f32c1338100
SHA1 36ea97ff2b0e4ba704ca38860b71690fec35255a
SHA512 07315a1882a77fb76b262ada149aac2fa816e6980adb267d05b592c6921247e8c5d5d90a2dc4c260da6967aaba8304e59d00ec42e722ce67eaba9d372cce4a3c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1860	732	regsvr32.exe	69
PID 732 wrote to memory of 1860	732	regsvr32.exe	69
PID 732 wrote to memory of 1860	732	regsvr32.exe	69
PID 1860 wrote to memory of 2804	1860	regsvr32.exe	70
PID 1860 wrote to memory of 2804	1860	regsvr32.exe	70
PID 1860 wrote to memory of 2804	1860	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a3a6a149d7c4126d6924f32c1338100.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a3a6a149d7c4126d6924f32c1338100.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9a3a6a149d7c4126d6924f32c1338100.dll",DllRegisterServer
    3⤵
    PID:2804

memory/1860-115-0x0000000000FE0000-0x0000000001005000-memory.dmp

Download