emotet | 8c5cd9820ea8eba077b52683cc33799d46e67e9526b53df24f88364af88284e7

Analysis

Target
930d0cee2d7816e04cf77e38ffa801ea.dll
Size 642KB
Sample220125-ld7whadaan
SHA256 8c5cd9820ea8eba077b52683cc33799d46e67e9526b53df24f88364af88284e7
MD5 930d0cee2d7816e04cf77e38ffa801ea
SHA1 a904b56e44c49dd02752e74e6620ee2100f16477
SHA512 a2b7e6c2008371d028c1e98f74834ad8befac5473d030f21e81c68163e7f639a261e78ef7852cd11763397b5f86af9530d9de3d5a543ad8bf7e02488b44168aa
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1148	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\930d0cee2d7816e04cf77e38ffa801ea.dll",DllRegisterServer
    3⤵
    PID:1148

memory/1412-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1492-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/1492-57-0x0000000000440000-0x0000000000468000-memory.dmp

Download