emotet | 5c4bc205ae6f938a2dc397f0f75ca5b85f8b4b75570bfa8bd955a7adf04c49a1

Analysis

Target
0b2122c92db73ca7d32e46bb2a900b6c.dll
Size 469KB
Sample220117-2wpewaeaej
SHA256 5c4bc205ae6f938a2dc397f0f75ca5b85f8b4b75570bfa8bd955a7adf04c49a1
MD5 0b2122c92db73ca7d32e46bb2a900b6c
SHA1 d596357e6d2f73e089cfb70db5a988f7367137b9
SHA512 86465144707213b64f63dc3923574d56a88096c1d42cea696d8a58c308227e817793399e2cec735057f5a566b87254d55222c5ac0ad200e868fcd5e1454e7d5d
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 1272 wrote to memory of 612	1272	regsvr32.exe	27
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28
PID 612 wrote to memory of 656	612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0b2122c92db73ca7d32e46bb2a900b6c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0b2122c92db73ca7d32e46bb2a900b6c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0b2122c92db73ca7d32e46bb2a900b6c.dll",DllRegisterServer
    3⤵
    PID:656

memory/612-57-0x0000000075021000-0x0000000075023000-memory.dmp

Download

memory/612-59-0x00000000001E3000-0x00000000001E4000-memory.dmp

Download

memory/612-58-0x00000000001C1000-0x00000000001E3000-memory.dmp

Download

memory/1272-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Download