emotet | eb9995bc762a0bc4c722db65fb83a9c8b8f9e40b3ed876940aa8e6dd374adb45

Analysis

Target
b7d93340b9c4ca9a1957238f7af1df8c.dll
Size 612KB
Sample220122-afgljsebh5
SHA256 eb9995bc762a0bc4c722db65fb83a9c8b8f9e40b3ed876940aa8e6dd374adb45
MD5 b7d93340b9c4ca9a1957238f7af1df8c
SHA1 9657e7a6bfea7d383a859c42cd8a8cce05b451c3
SHA512 c18a95a2c9ec11c4f72dfb07fe2ac5d701b4dfad58dec033aa3f6d7ffdaaa6cd3bd37d156eccb1b9503899c6799c7c78d80f05ca752bc749ac226a31ed326af9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 828 wrote to memory of 1156	828	regsvr32.exe	27
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28
PID 1156 wrote to memory of 588	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll",DllRegisterServer
    3⤵
    PID:588

memory/828-55-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download

memory/1156-56-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/1156-57-0x0000000000220000-0x0000000000246000-memory.dmp

Download