emotet | b41b021062a852cc2db72da07bdfd4c2ab8c98f158cbf5d2d9cc696fa11def07

Analysis

Target
30c6fb8fb722aa4ce682debddd97724b.dll
Size 408KB
Sample220118-2sa33sdggq
SHA256 b41b021062a852cc2db72da07bdfd4c2ab8c98f158cbf5d2d9cc696fa11def07
MD5 30c6fb8fb722aa4ce682debddd97724b
SHA1 25a3138dd9a3818b5d563e63c6701259132e1832
SHA512 cc1e4d19f865d4fb21335b24444ad29d762662155824357b596fde6ef17b702a1ea0e5d46c949ec6e2a0a86523911d54c8cd4969c2d03da8a53d68c73b07c929
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 1768 wrote to memory of 304	1768	regsvr32.exe	27
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28
PID 304 wrote to memory of 1584	304	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:304
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\30c6fb8fb722aa4ce682debddd97724b.dll",DllRegisterServer
    3⤵
    PID:1584

memory/304-56-0x00000000762C1000-0x00000000762C3000-memory.dmp

Download

memory/304-58-0x00000000001F0000-0x0000000000218000-memory.dmp

Download

memory/1768-55-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Download