emotet | 2059dcafd15a1d23ec459d44e340547388bf7bbe1edf60aaa4c49a2986425569

Analysis

Target
c4cf1e2557ff4553209b402d827e9961.dll
Size 596KB
Sample220125-wsllxscff7
SHA256 2059dcafd15a1d23ec459d44e340547388bf7bbe1edf60aaa4c49a2986425569
MD5 c4cf1e2557ff4553209b402d827e9961
SHA1 9f32713c5518f236660db4b21fdf7e975f80f3b1
SHA512 3dc8b5afd2bc9f4efe059021f07889f449769dee78330e8bfbf5b79ef6477e8ff19bd1bd076ecf6ede1d2e9f4632212425f05e6c8a42d73abcfe647b7522fae0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1736	1316	regsvr32.exe	27
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28
PID 1736 wrote to memory of 324	1736	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll",DllRegisterServer
    3⤵
    PID:324

memory/1316-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1736-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/1736-57-0x00000000001A0000-0x00000000001C7000-memory.dmp

Download