emotet | 79c76ca904e7a8cec304f12186d50c8e85fc463e0a5fd96aa55bd0ff152e3949

Analysis

Target
d7addc219cea45e4c158d0d5fc77bff7.dll
Size 784KB
Sample220126-lasmeabcem
SHA256 79c76ca904e7a8cec304f12186d50c8e85fc463e0a5fd96aa55bd0ff152e3949
MD5 d7addc219cea45e4c158d0d5fc77bff7
SHA1 b5d7b76cebe729588dbe07488a4e670227f584ee
SHA512 c7058efd55ef2f284e55f3ad370817dd456c3088975ed570dc92dd722b88e9378da18e64fd7c2cfab8794ffc5211d42912b6bfa485709c23fe729f03fb4e752e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d7addc219cea45e4c158d0d5fc77bff7.dll",DllRegisterServer
    3⤵
    PID:1508

memory/1516-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1516-57-0x0000000000950000-0x0000000000977000-memory.dmp

Download

memory/1572-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download