emotet | 356d6ff7aad2a7d0f987eb4c0d3b5157d50e70369df2a5055b3fa842e642b8d5

Analysis

Target
triage_dropped_file.dll
Size 624KB
Sample220121-rb4c7ahfc3
SHA256 356d6ff7aad2a7d0f987eb4c0d3b5157d50e70369df2a5055b3fa842e642b8d5
MD5 04a5bd3e1ccc8e7e3eeb479ec8a2e467
SHA1 9b7e654582bf5e7955952dae7ec8ce35546be9f8
SHA512 840a8089f19cc5026cf7727f0f207e4b994302224954501e0d4196277008293cd763d17b8027ad16e1fce114536b1aae3403a5a53521ecfd031dd48b53bb867f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 2008 wrote to memory of 1072	2008	regsvr32.exe	27
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28
PID 1072 wrote to memory of 572	1072	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll",DllRegisterServer
    3⤵
    PID:572

memory/1072-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1072-56-0x00000000001A0000-0x00000000001C6000-memory.dmp

Download

memory/2008-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download