emotet | 21f6d02ff4e35e203a48b67a424135fc6bae177fa4e6d827612c924585b3a6f6

Analysis

Target
f5f77090e40dcb8472497bb7c46bdc28.dll
Size 408KB
Sample220119-rc975aadhj
SHA256 21f6d02ff4e35e203a48b67a424135fc6bae177fa4e6d827612c924585b3a6f6
MD5 f5f77090e40dcb8472497bb7c46bdc28
SHA1 abce52afe2532dcde08d72c53e753a1ce4e6ccff
SHA512 a93bf8d6b4b18982fc33fe9e6e9139a1a4c5fdbca42be2fd238e842eb31c624ade27c70e554d16963aea1fbc8df412305e54a3d3424dfa25d0cf380b561b7f0e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f5f77090e40dcb8472497bb7c46bdc28.dll",DllRegisterServer
    3⤵
    PID:1688

memory/944-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1668-55-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1668-56-0x00000000001C0000-0x00000000001E6000-memory.dmp

Download