emotet | ab5eb24c0d89f3d5eb0f223f0a366ca92e94e4c70db2c7c08586605189eb9d18

Analysis

Target
7753d6592a3391470407270d30d556b9.dll
Size 615KB
Sample220122-qk384sbcd4
SHA256 ab5eb24c0d89f3d5eb0f223f0a366ca92e94e4c70db2c7c08586605189eb9d18
MD5 7753d6592a3391470407270d30d556b9
SHA1 50710c44603919c406eef833f19b059fa4b65993
SHA512 cb5f3d0413474532065d5f5753c460b943b1cbd9582552b062cc75ecdaea1206d41c2a4b7b5c7624bee3a85563913ff0c2067f72f8c5f55121de594b096ab6e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1224 wrote to memory of 1636	1224	regsvr32.exe	27
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28
PID 1636 wrote to memory of 668	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7753d6592a3391470407270d30d556b9.dll",DllRegisterServer
    3⤵
    PID:668

memory/1224-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download

memory/1636-56-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/1636-57-0x00000000003D0000-0x00000000003F6000-memory.dmp

Download