emotet | 0eb8b53883dbf1a25bfcbb8e85b0f895f009c83bb568286c654ea9cabe31413c

Analysis

Target
f7f576a4169207c90387d70aa835b7f3.dll
Size 460KB
Sample220117-2bed6sdca6
SHA256 0eb8b53883dbf1a25bfcbb8e85b0f895f009c83bb568286c654ea9cabe31413c
MD5 f7f576a4169207c90387d70aa835b7f3
SHA1 57cb0067837251a21a045bbbf57db4f8bf692142
SHA512 043e6cf13fad1ec72b8f1d42517362ee57b48f64150a75267057aa5eb4aaa94c0fc4a33b617b333fef379871e40215e440a2dbb8b2888adc40994a8f2ad34f2a
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1100 wrote to memory of 1840	1100	regsvr32.exe	27
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28
PID 1840 wrote to memory of 584	1840	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f7f576a4169207c90387d70aa835b7f3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f7f576a4169207c90387d70aa835b7f3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f7f576a4169207c90387d70aa835b7f3.dll",DllRegisterServer
    3⤵
    PID:584

memory/1100-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download

memory/1840-57-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/1840-59-0x00000000001B3000-0x00000000001B4000-memory.dmp

Download

memory/1840-58-0x0000000000191000-0x00000000001B3000-memory.dmp

Download