emotet | 0667fabc99dcc6f28aeb03f2e50c80c22312d645fdb593e8be97748d30859243

Analysis

Target
r2J9jEpSzDLpV.dll
Size 784KB
Sample220126-yleadaaad8
SHA256 0667fabc99dcc6f28aeb03f2e50c80c22312d645fdb593e8be97748d30859243
MD5 3ad36fdcd52e0bf8060501f4b92b05f9
SHA1 1dfa8c003a405ed579c049e5352cb81a8b832fd8
SHA512 fac0368d81d73ef555140a32e0fa914ab0599dea79c26f3a56643f1e559a0c6427e79000e8371a56aab583147d0baa9b456eea038635784f6c839d86ae2dc96d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1928 wrote to memory of 1136	1928	regsvr32.exe	27
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28
PID 1136 wrote to memory of 816	1136	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\r2J9jEpSzDLpV.dll",DllRegisterServer
    3⤵
    PID:816

memory/1136-56-0x0000000076511000-0x0000000076513000-memory.dmp

Download

memory/1136-57-0x00000000001D0000-0x00000000001F7000-memory.dmp

Download

memory/1928-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

Download