emotet | e73c1e8bc19cc3b4c77c39fa58e83b014459df33e03cf7bb9f9946bee0c44267

Analysis

Target
3041f68ba28ae1ef63f9b75747a53ca7.dll
Size 676KB
Sample220124-18hmesbchk
SHA256 e73c1e8bc19cc3b4c77c39fa58e83b014459df33e03cf7bb9f9946bee0c44267
MD5 3041f68ba28ae1ef63f9b75747a53ca7
SHA1 650a8b8a687b948d49657f9acf1bb33eadf76dda
SHA512 6d5190b6a8c32a29ca5062e4706ba586c81aebf01896b040eaee15def0b7375d2c3eb51fa4a22c629827d3275bf0085430a7771648890270d36b39d04b61146f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1720	1588	regsvr32.exe	27
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28
PID 1720 wrote to memory of 656	1720	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll",DllRegisterServer
    3⤵
    PID:656

memory/1588-53-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Download

memory/1720-54-0x0000000076151000-0x0000000076153000-memory.dmp

Download

memory/1720-55-0x0000000000400000-0x0000000000428000-memory.dmp

Download