emotet | cd543d667e2c5fdd5ad2c5ace779ef6ec2e77797565a042531b50fbd42113107

Analysis

Target
6efba9d68e7b509b06c08ba0a8da1324.dll
Size 469KB
Sample220117-259geaeber
SHA256 cd543d667e2c5fdd5ad2c5ace779ef6ec2e77797565a042531b50fbd42113107
MD5 6efba9d68e7b509b06c08ba0a8da1324
SHA1 ee551d073ea024745dab15b41fec131c7f3e374e
SHA512 926124effa9a66f3664fb6059524fec99adddd9435cffbd92fe709b47676d18ab670fe40403b31e9e9352e44121084857a1d01c2d1404012836d30ed08d45798
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 792 wrote to memory of 1592	792	regsvr32.exe	27
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28
PID 1592 wrote to memory of 1056	1592	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\6efba9d68e7b509b06c08ba0a8da1324.dll",DllRegisterServer
    3⤵
    PID:1056

memory/792-55-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Download

memory/1592-57-0x0000000075321000-0x0000000075323000-memory.dmp

Download

memory/1592-59-0x0000000000243000-0x0000000000244000-memory.dmp

Download

memory/1592-58-0x0000000000221000-0x0000000000243000-memory.dmp

Download