emotet | e1a55a327c7c2c1a5d215f9e13d836ada2fef0aecf12013fea68469920020106

Analysis

Target
XRkuPnNPMWjG2ffyf5.dll
Size 784KB
Sample220126-naweeacbbn
SHA256 e1a55a327c7c2c1a5d215f9e13d836ada2fef0aecf12013fea68469920020106
MD5 d44f76e2552fb7e313aa81ce996ad94f
SHA1 0a981cec91868615bc361dc1353d38f7238881a6
SHA512 2b0f3c07c86037449600de7ef32afd6a5d5ca8e60a513fa9a7122f23809f967aafc35af9b6c71cd7e74b01534cd3ae9831ff2c0cc77b663fa5e96b61abbdcb96
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1752 wrote to memory of 1528	1752	regsvr32.exe	27
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28
PID 1528 wrote to memory of 964	1528	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\XRkuPnNPMWjG2ffyf5.dll",DllRegisterServer
    3⤵
    PID:964

memory/1528-55-0x00000000769D1000-0x00000000769D3000-memory.dmp

Download

memory/1528-56-0x0000000000250000-0x0000000000277000-memory.dmp

Download

memory/1752-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download