emotet | a13717ac7014e0eb85a5d0a2d3968eb63ba14c7a18245e50d0f7e2eecc9f57dd

Analysis

Target
xihllT5.dll
Size 258KB
Sample211209-we6d6sdbb7
SHA256 a13717ac7014e0eb85a5d0a2d3968eb63ba14c7a18245e50d0f7e2eecc9f57dd
MD5 eb86b85a7fec7fe6aade1d4f1cfc9fde
SHA1 5755575afa086a7d19e4f5042cb6e54cd2e9bd53
SHA512 42d83c154cdcac04204288b1cdc87b189ddf91cb09e49e4904b4da6fb10323da39addad6b7f4f3f0fbd5db7d8786a3d721d8004041b8687c84dcbc530b618728
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1480	1816	regsvr32.exe	27
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28
PID 1480 wrote to memory of 1952	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xihllT5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xihllT5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\xihllT5.dll",DllRegisterServer
    3⤵
    PID:1952

memory/1480-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download

memory/1480-59-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/1816-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download