emotet | f1e34014f42b3e55035e60d9ca98a62da034f71ee491a5f6af92c7c33065550b

Analysis

Target
c53f107e32e923bae19131a5622a96df.dll
Size 258KB
Sample211209-cf5pgsbhen
SHA256 f1e34014f42b3e55035e60d9ca98a62da034f71ee491a5f6af92c7c33065550b
MD5 c53f107e32e923bae19131a5622a96df
SHA1 a380551069df81a7c5ca96668f8e7bca19d94cf4
SHA512 a28e36bec1c4d48da3df0f3e4880ea0c5f13636c98cee1eb3e2c3d8599b41baf0058c2c1213f1e89de7954dc4aad9e0bdac9ba2bd6cbb9bcf0468c7a4e3bc4e3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1620 wrote to memory of 1624	1620	regsvr32.exe	27
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28
PID 1624 wrote to memory of 1384	1624	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c53f107e32e923bae19131a5622a96df.dll",DllRegisterServer
    3⤵
    PID:1384

memory/1620-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Download

memory/1624-57-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Download

memory/1624-59-0x0000000010000000-0x0000000010025000-memory.dmp

Download