emotet | 115dcdd9207900e1fdaa0e5089ea029596d3da345e34ebfc5fbdaa6dd78e57dd

Analysis

Target
BoDSs7MrmhytYnFDSBA.dll
Size 784KB
Sample220126-naweeacbbm
SHA256 115dcdd9207900e1fdaa0e5089ea029596d3da345e34ebfc5fbdaa6dd78e57dd
MD5 1103116cbb4ba9d90e44aa2612916fe4
SHA1 1c0a37e9441782a3fe18143a814821d9d4055354
SHA512 85864ce5a0d6f4f741280faa7648295581ebe5bf29a5bae1644ac74ca18298243f36ab3c0a3c3b3c263fe30c81b83bb0fb583c834422ca1e613b5f786ef785e1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1468	1296	regsvr32.exe	27
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28
PID 1468 wrote to memory of 2036	1468	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll",DllRegisterServer
    3⤵
    PID:2036

memory/1296-53-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download

memory/1468-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1468-55-0x0000000000410000-0x0000000000437000-memory.dmp

Download