emotet | 2c04f7291ee2aa3df0cfd0597d9a3d6b8eabf4da9be10841cb62382b20e0b1e3

Analysis

Target
18602da59364e62a42cb039abc19afb2.dll
Size 705KB
Sample220126-splwqsehf4
SHA256 2c04f7291ee2aa3df0cfd0597d9a3d6b8eabf4da9be10841cb62382b20e0b1e3
MD5 18602da59364e62a42cb039abc19afb2
SHA1 1bb19c15a14378747377d1d42e35642875248367
SHA512 e00b9a8095a5d1e1d3ca8032fa07e1d40901c600bac31d9ceb88342253cda4775e10db5f1bba3d5fda3344e1299cfba9e7d4bebdcb01e9361cdc604e498a906d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 732 wrote to memory of 1580	732	regsvr32.exe	27
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28
PID 1580 wrote to memory of 468	1580	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\18602da59364e62a42cb039abc19afb2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\18602da59364e62a42cb039abc19afb2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\18602da59364e62a42cb039abc19afb2.dll",DllRegisterServer
    3⤵
    PID:468

memory/732-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1580-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1580-57-0x0000000000520000-0x0000000000545000-memory.dmp

Download