emotet | e39bda1e5d4f990da43aad6b5ddd94ec34b189f4ed0eca1771a1ffae6a82995b

Analysis

Target
D4cEFfIh8TP.dll
Size 612KB
Sample220121-wyrp5aahdn
SHA256 e39bda1e5d4f990da43aad6b5ddd94ec34b189f4ed0eca1771a1ffae6a82995b
MD5 c6d8d14d9a9f4649695fb9ddfeb60c0a
SHA1 4a1580e8939656fa10a5ac57a38dab14e2c86abb
SHA512 bc736e3326bbb36a51903d292d395cb131c56f086b3325eb3ccb52ff2006453d58b931fa20b709abe58a9b0a718fac0ef2d086a1c3432429760bade15c76741a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1488 wrote to memory of 1656	1488	regsvr32.exe	27
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1296	1656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\D4cEFfIh8TP.dll",DllRegisterServer
    3⤵
    PID:1296

memory/1488-54-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

Download

memory/1656-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1656-56-0x0000000000820000-0x0000000000846000-memory.dmp

Download