emotet | 00fb6971817095603fc969736e9ea7ca1e2783bae2c0ca896b74065f6eea718a

Analysis

Target
a756b033477e98d537ece195ffb4cd8b.dll
Size 258KB
Sample211209-pll6jsdcbj
SHA256 00fb6971817095603fc969736e9ea7ca1e2783bae2c0ca896b74065f6eea718a
MD5 a756b033477e98d537ece195ffb4cd8b
SHA1 09da684da99ec0de6bd03462098a87ab7dd0dc45
SHA512 0b0bb86452a4d3e486dc25c2975a080756d2d0f2cafe19c9901b97a3cd49d2a530c987183bf92acf047d24724d79a37cafdd66eff303be2616f848533250f76b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 844 wrote to memory of 1592	844	regsvr32.exe	27
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1028	1592	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a756b033477e98d537ece195ffb4cd8b.dll",DllRegisterServer
    3⤵
    PID:1028

memory/844-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Download

memory/1592-56-0x0000000076151000-0x0000000076153000-memory.dmp

Download

memory/1592-59-0x0000000010000000-0x0000000010025000-memory.dmp

Download