emotet | d0bdd36ed8dbbaf703e564a6acb746f49f7841709d1f42aca4e00c817df84b3a

Analysis

Target
9f80de3bb0a081f034afa330d74bee28.dll
Size 496KB
Sample220127-bpj9gaddcr
SHA256 d0bdd36ed8dbbaf703e564a6acb746f49f7841709d1f42aca4e00c817df84b3a
MD5 9f80de3bb0a081f034afa330d74bee28
SHA1 867cdd5192f59a8971b1541c63e577c4021ecfa4
SHA512 7ab963faa8c7ddd9f9db909363694911eacea1a277c300f214673c65705bb5e6a745a9d5dc428c5a24c9179f099cafeb300df71a556eced7b7d862dd6abc90d2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3708	3508	regsvr32.exe	69
PID 3508 wrote to memory of 3708	3508	regsvr32.exe	69
PID 3508 wrote to memory of 3708	3508	regsvr32.exe	69
PID 3708 wrote to memory of 4024	3708	regsvr32.exe	70
PID 3708 wrote to memory of 4024	3708	regsvr32.exe	70
PID 3708 wrote to memory of 4024	3708	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9f80de3bb0a081f034afa330d74bee28.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9f80de3bb0a081f034afa330d74bee28.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9f80de3bb0a081f034afa330d74bee28.dll",DllRegisterServer
    3⤵
    PID:4024

memory/3708-115-0x0000000000190000-0x00000000001B5000-memory.dmp

Download