emotet | 42b16a2371206324cfbc1af4dcb8c6f177dcd5490b1874cfebb08e1e44d5f007

Analysis

Target
96bced57d7f74780fd2a12c0d4661102.dll
Size 536KB
Sample220128-wj6whaabb3
SHA256 42b16a2371206324cfbc1af4dcb8c6f177dcd5490b1874cfebb08e1e44d5f007
MD5 96bced57d7f74780fd2a12c0d4661102
SHA1 6b2d91cf19323193eec48ff958c62829932de52d
SHA512 86c739304d008ad6d50c0db37e1f1e4b4366608ea846300d3bf334871c302e140b1a5c16410062c185f43fd002810c82c0f21f8853b88f901c2181b3f8b0cd6a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 2744	3776	regsvr32.exe	68
PID 3776 wrote to memory of 2744	3776	regsvr32.exe	68
PID 3776 wrote to memory of 2744	3776	regsvr32.exe	68
PID 2744 wrote to memory of 452	2744	regsvr32.exe	69
PID 2744 wrote to memory of 452	2744	regsvr32.exe	69
PID 2744 wrote to memory of 452	2744	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\96bced57d7f74780fd2a12c0d4661102.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\96bced57d7f74780fd2a12c0d4661102.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\96bced57d7f74780fd2a12c0d4661102.dll",DllRegisterServer
    3⤵
    PID:452

memory/2744-117-0x0000000004300000-0x0000000004325000-memory.dmp

Download