emotet | 9284fd2cb8c5594f077aa12fa78a72f12ce6287bb52d14f7495aca68ef6b380d

Analysis

Target
4YB0E11V.dll
Size 560KB
Sample220120-twddlsafek
SHA256 9284fd2cb8c5594f077aa12fa78a72f12ce6287bb52d14f7495aca68ef6b380d
MD5 8c124aaa9af64fc38bc0998c42a3b907
SHA1 60a9062bf21bd2801237890a514281a94e89a562
SHA512 9459176cc89233ef3497c1323576feeeb37b79fc322ee1f431ef26324df5ec30f2789e54df1996fb854df275b97073b2d2a17bd1ebbd5da74ef6055f179f7a5c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 944 wrote to memory of 1668	944	regsvr32.exe	27
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4YB0E11V.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4YB0E11V.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4YB0E11V.dll",DllRegisterServer
    3⤵
    PID:1688

memory/944-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1668-55-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1668-57-0x0000000000350000-0x0000000000378000-memory.dmp

Download