emotet | d2d1e43adbae3d155a0034d74bf732af9747dc464c764b9e58b3241e5b44a401

Analysis

Target
Fu05pB7viz.dll
Size 544KB
Sample220128-wj669sabb9
SHA256 d2d1e43adbae3d155a0034d74bf732af9747dc464c764b9e58b3241e5b44a401
MD5 049318ab91607f4e0a6ae193b0910a4f
SHA1 01204e9c30e71113c748c927fca801b65dcafb73
SHA512 e9d06d94a5bd6287f4717394b4666ebbf7b3ae776e150ebce0ed67a46b13bfae6c7a7c7258533d6027704c35265e740363acef5d6031b87b094034e7bbc56728
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2676	2664	regsvr32.exe	68
PID 2676 wrote to memory of 3036	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3036	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3036	2676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Fu05pB7viz.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Fu05pB7viz.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Fu05pB7viz.dll",DllRegisterServer
    3⤵
    PID:3036

memory/2676-119-0x0000000004E10000-0x0000000004E37000-memory.dmp

Download