emotet | c8c14453e131c61ab6a3cfa38e8edfadf2ca15036c32f1ca781393d0b3579e65

Analysis

Target
7d9b6aad356b7d4bf7049ffe26e963af.dll
Size 642KB
Sample220125-ld7whadaam
SHA256 c8c14453e131c61ab6a3cfa38e8edfadf2ca15036c32f1ca781393d0b3579e65
MD5 7d9b6aad356b7d4bf7049ffe26e963af
SHA1 f1c16e95fa6581bc134e077ebdb8d48b2c9a0301
SHA512 09b6a790743c699ea3844b47d7b4d7e52353e079e2b10428e2df37d02797fd0c515e70100df6b8ffc3f05bd806c48556a108456f3e565cb49cd451e01621bc2b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 952 wrote to memory of 1556	952	regsvr32.exe	27
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28
PID 1556 wrote to memory of 1828	1556	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll",DllRegisterServer
    3⤵
    PID:1828

memory/952-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/1556-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Download

memory/1556-56-0x00000000009D0000-0x00000000009F8000-memory.dmp

Download