emotet | 8c4dfe72da192f8b23791aa58946fe56447413db63eabbc090d3704352ea0e68

Analysis

Target
cVu3dpMBAfpLTuqYZ.dll
Size 745KB
Sample211202-mg376aefbq
SHA256 8c4dfe72da192f8b23791aa58946fe56447413db63eabbc090d3704352ea0e68
MD5 36b056d7d5bcb93e29434289bb197865
SHA1 029bf7591694fc662e481c9a7a45c86c9f2a37e3
SHA512 badcfbb42bb13e66dc6667ca57e36e0ad66d9a264f11dbc428cd6f477cd9001133309c241d652e2ae23e86eaa1f198439634f285a313e04c5575df515033e1f6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 1632 wrote to memory of 548	1632	regsvr32.exe	27
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29
PID 548 wrote to memory of 1472	548	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cVu3dpMBAfpLTuqYZ.dll",DllRegisterServer
    3⤵
    PID:1472

memory/548-57-0x00000000760C1000-0x00000000760C3000-memory.dmp

Download

memory/548-60-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1632-55-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Download