emotet | 2d59b1cca0af311c7368ef8f088e5ac94ab499e175b5bb0d2226d60d0a2cd160

Analysis

Target
f67858c11fa5b1565f7500548ecb51de.dll
Size 408KB
Sample220119-qb3afsaack
SHA256 2d59b1cca0af311c7368ef8f088e5ac94ab499e175b5bb0d2226d60d0a2cd160
MD5 f67858c11fa5b1565f7500548ecb51de
SHA1 4b7daf0d13151caa10a4276d07b1aeff09ed3027
SHA512 df3deba1d5ac748ddafd0ee72bfe28ebbf81a82abf424fc41f8973e418bb498e3693d199bf3c96f4b0cf5e30801305cc88e9b664f2252c5aba871123cc3797ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1308 wrote to memory of 1568	1308	regsvr32.exe	27
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28
PID 1568 wrote to memory of 2036	1568	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f67858c11fa5b1565f7500548ecb51de.dll",DllRegisterServer
    3⤵
    PID:2036

memory/1308-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1568-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1568-57-0x0000000000370000-0x0000000000396000-memory.dmp

Download