emotet | 14132aa34ecf5adb006f2be035488838b09985c6c48aee198d3871369e2eeeae

Analysis

Target
CF8PDpl9Nf7xM.dll
Size 496KB
Sample220127-khnsraacb2
SHA256 14132aa34ecf5adb006f2be035488838b09985c6c48aee198d3871369e2eeeae
MD5 a9bd563bbd2982c7a3602157dfc7a15d
SHA1 f1f9f107905d9cb4066a228dde8380c338dc893a
SHA512 e23954c19300396a16d3e343c3a9686704c5827307fea442dc7afd55dd76623ec9c6e912eb64be3ac73eceb338144c79446460ce1887eb3242ba491a175bea59
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4080	4016	regsvr32.exe	69
PID 4016 wrote to memory of 4080	4016	regsvr32.exe	69
PID 4016 wrote to memory of 4080	4016	regsvr32.exe	69
PID 4080 wrote to memory of 4276	4080	regsvr32.exe	70
PID 4080 wrote to memory of 4276	4080	regsvr32.exe	70
PID 4080 wrote to memory of 4276	4080	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll",DllRegisterServer
    3⤵
    PID:4276

memory/4080-115-0x0000000004F40000-0x0000000004F65000-memory.dmp

Download