emotet | 8424f1cdda30b565f1905bbd4996ef49988388c3c73ee18e13ca6f794bdc90fe

Analysis

Target
ac1e9bc8492fc9a6fb749886352792d5.dll
Size 784KB
Sample220126-vn422agbd3
SHA256 8424f1cdda30b565f1905bbd4996ef49988388c3c73ee18e13ca6f794bdc90fe
MD5 ac1e9bc8492fc9a6fb749886352792d5
SHA1 f0689b02fc9482df5a3deb4a8be1d1383bdca73c
SHA512 9f3f6a432af807e6548fcb1330c105909382da9c4990ff7be86bed835b19e464618d55969af1d2282c49aa442d621fb95d36df62679e626e0bef34b3e8f422e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1212	1636	regsvr32.exe	27
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28
PID 1212 wrote to memory of 952	1212	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ac1e9bc8492fc9a6fb749886352792d5.dll",DllRegisterServer
    3⤵
    PID:952

memory/1212-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1212-58-0x0000000000740000-0x0000000000767000-memory.dmp

Download

memory/1636-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download