emotet | ce577b2606bda6a496991598ff294d3a1e90132b243c6cb2fc5eb6543366f83a

Analysis

Target
bfbe1cbaba2219a7628af4a648fea6d1.dll
Size 642KB
Sample220125-s23d9aabal
SHA256 ce577b2606bda6a496991598ff294d3a1e90132b243c6cb2fc5eb6543366f83a
MD5 bfbe1cbaba2219a7628af4a648fea6d1
SHA1 419037f6c220b69e247ee9787d8d13aadb9bf0a6
SHA512 9ceaa2c41dba12491b1a937d1fcd99ac63eb222420334434f7dc53db7f5877a1715966367ceca05a688696c1250102c91a6708bd503b3fd071ef1faab99e696d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 1612 wrote to memory of 964	1612	regsvr32.exe	27
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28
PID 964 wrote to memory of 1872	964	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bfbe1cbaba2219a7628af4a648fea6d1.dll",DllRegisterServer
    3⤵
    PID:1872

memory/964-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/964-56-0x0000000001D80000-0x0000000001DA8000-memory.dmp

Download

memory/1612-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download