emotet | 02c68d6e586e5865d36d9117984951546955747591f0a035014c05d9cb1ec79f

Analysis

Target
73ff2f76d708576576925501697a333c.dll
Size 784KB
Sample220126-vx5d6agcd5
SHA256 02c68d6e586e5865d36d9117984951546955747591f0a035014c05d9cb1ec79f
MD5 73ff2f76d708576576925501697a333c
SHA1 8166b591ef2ec02a4ba73df7ed5b3fe2170e33ce
SHA512 7403a98ef7c39c3b6bfb8bb8d0152bf2808e894778a1056004966b14c4ae63adc2bbfbad104b93a4f6ad2df4fba511aaa2b573f8d62e0e3f892f086f7b0164db
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28
PID 1100 wrote to memory of 696	1100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll",DllRegisterServer
    3⤵
    PID:696

memory/1100-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1100-56-0x00000000001E0000-0x0000000000207000-memory.dmp

Download

memory/1688-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download