emotet | 0611448f770b80b0e753530f031884f40b884fc7eef909707af91fade2147bbb

Analysis

Target
239de376d1c934ec43873863d91b1477.dll
Size 602KB
Sample220119-z7bl2sddc8
SHA256 0611448f770b80b0e753530f031884f40b884fc7eef909707af91fade2147bbb
MD5 239de376d1c934ec43873863d91b1477
SHA1 81da4867a1597c34b0b492985b4ebf8864409f84
SHA512 3d70529e9816785406ffab98f75bfbe5d258d85c901051fdcc0bf94aee0ba537553f665bc76eff193bb4999bdd47ce188202657eb7fd8a9f5d3867d71585e859
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 732 wrote to memory of 948	732	regsvr32.exe	27
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28
PID 948 wrote to memory of 1444	948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\239de376d1c934ec43873863d91b1477.dll",DllRegisterServer
    3⤵
    PID:1444

memory/732-55-0x000007FEFC2A1000-0x000007FEFC2A3000-memory.dmp

Download

memory/948-56-0x0000000076B81000-0x0000000076B83000-memory.dmp

Download

memory/948-57-0x0000000000240000-0x0000000000268000-memory.dmp

Download