emotet | 22b8e1caf88ec795b68d57a768252d9ae059fda079cf00d4b16084b6fad5a007

Analysis

Target
7d5be516deb9a85d3c82460f5cdee56b.dll
Size 705KB
Sample220126-sn192aedcl
SHA256 22b8e1caf88ec795b68d57a768252d9ae059fda079cf00d4b16084b6fad5a007
MD5 7d5be516deb9a85d3c82460f5cdee56b
SHA1 640c2a207f2680b0bbbcad343d9b8a768eee7d8a
SHA512 9e9492bbf3cbfbf84a03796f3afc97c7474ecc016fd7e9491418ac382ecf65fa434d1b6d20038003a5fd14ae120f1cdeb9b4e7f3dac16020e86272d5a0e9f11c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 756 wrote to memory of 1956	756	regsvr32.exe	27
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28
PID 1956 wrote to memory of 324	1956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d5be516deb9a85d3c82460f5cdee56b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d5be516deb9a85d3c82460f5cdee56b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7d5be516deb9a85d3c82460f5cdee56b.dll",DllRegisterServer
    3⤵
    PID:324

memory/756-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1956-55-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1956-56-0x0000000000520000-0x0000000000545000-memory.dmp

Download