emotet | e823ebdccbe9cb156d26d350e08022a748e72c6b5cbc31e8a61b821bd707b4e1

Analysis

Target
h4XAT.dll
Size 784KB
Sample220126-nav4mscbbk
SHA256 e823ebdccbe9cb156d26d350e08022a748e72c6b5cbc31e8a61b821bd707b4e1
MD5 c0b90249e5501ea80d5158d5d859a0eb
SHA1 3afb57046c798e636c30869030fb57e9d5bf22e3
SHA512 57fd83c77d789a60d607c18da53d7249681f6fc2354859ed6980bfc5dc85ea38a8cf499fd1885ecd21fbb7b97f9e1b4d1fab4c6f251fd742c8f0ff325b03125f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1404 wrote to memory of 1612	1404	regsvr32.exe	27
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28
PID 1612 wrote to memory of 828	1612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\h4XAT.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\h4XAT.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\h4XAT.dll",DllRegisterServer
    3⤵
    PID:828

memory/1404-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download

memory/1612-56-0x0000000075F81000-0x0000000075F83000-memory.dmp

Download

memory/1612-57-0x00000000002C0000-0x00000000002E7000-memory.dmp

Download