emotet | c1254259ee85998dfb96c19c1f01fc892603bdd55a11368e10938bdd4e972255

Analysis

Target
IT8GHjQ.dll
Size 624KB
Sample220121-lerkxaefdr
SHA256 c1254259ee85998dfb96c19c1f01fc892603bdd55a11368e10938bdd4e972255
MD5 832e664a4889855375c5243c8e57c184
SHA1 49b9153bf82e043c5e2bf510a3fe1fef568b44b6
SHA512 cf08974d86ab55397101ce7f7e7a6c360ca9ccabb924bfd73cf31f5b2c1301507afb171eb5a46767784f63ca9d0fe85ab0fe20443958f212171e947730e38263
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 780 wrote to memory of 1480	780	regsvr32.exe	27
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28
PID 1480 wrote to memory of 744	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IT8GHjQ.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\IT8GHjQ.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\IT8GHjQ.dll",DllRegisterServer
    3⤵
    PID:744

memory/780-55-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1480-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

Download

memory/1480-57-0x00000000001B0000-0x00000000001D6000-memory.dmp

Download