emotet | 7a29ce889f3dca5f14bafc7a1d1f604bb80f092bfecb190ffaf8c58ccfd009b1

Analysis

Target
9e436f07bc3f29e341ad97bd1b23b108.dll
Size 1.0MB
Sample211208-ym477aadgp
SHA256 7a29ce889f3dca5f14bafc7a1d1f604bb80f092bfecb190ffaf8c58ccfd009b1
MD5 9e436f07bc3f29e341ad97bd1b23b108
SHA1 74b1ad3034dd4e6532d4c1f9f7f7f14c2e89b542
SHA512 0917dfcdf2ac378f94f2497db5d12d0d895863102bf711d1b0c665133464c883d45b32e83006e4aed3154754519ff50d8280fc24af8915855d052315e6049430
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1944 wrote to memory of 1876	1944	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9e436f07bc3f29e341ad97bd1b23b108.dll",DllRegisterServer
    3⤵
    PID:1100

memory/1876-57-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1876-60-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1944-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download