emotet | bcf8a128ebd036fec4109d024107b191a66ad361c52626f16391ac4c9ca5b2f3

Analysis

Target
89837714ecdc7fc5c6377f5b71a86d8b.dll
Size 512KB
Sample220127-2stkescaap
SHA256 bcf8a128ebd036fec4109d024107b191a66ad361c52626f16391ac4c9ca5b2f3
MD5 89837714ecdc7fc5c6377f5b71a86d8b
SHA1 b970dabf3271db9da40038c6a37c0610a0a96a36
SHA512 2485dc922006248847d1c407c4120f5b784eb8a8c3c99b774183294d745edf0e1a16e2281a58025b01830d86a87a4b98a351c7bd0609548832b7f38af956c0a6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 1696 wrote to memory of 316	1696	regsvr32.exe	27
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28
PID 316 wrote to memory of 1064	316	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll",DllRegisterServer
    3⤵
    PID:1064

memory/316-55-0x0000000076001000-0x0000000076003000-memory.dmp

Download

memory/316-56-0x0000000000520000-0x0000000000545000-memory.dmp

Download

memory/1696-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

Download