emotet | 1635373c653326194786b15c37c0c9abccfb6841c65f58b4bcafa6b6eafdb942

Analysis

Target
118619aa75d5f92fac648f34c0cd74fd.dll
Size 504KB
Sample220127-a48d6sdch8
SHA256 1635373c653326194786b15c37c0c9abccfb6841c65f58b4bcafa6b6eafdb942
MD5 118619aa75d5f92fac648f34c0cd74fd
SHA1 6b0026411525c378f2e346f3b2e542207a963c0f
SHA512 44e9c67a2a3da77cd8dd876fec002ac29566a9fc5289bd740e0a74f59598119ef1d966682aa7044aec5ab465c656f0333194c3eed14d7558fd18670821f325f8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 744 wrote to memory of 1864	744	regsvr32.exe	27
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28
PID 1864 wrote to memory of 1656	1864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\118619aa75d5f92fac648f34c0cd74fd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\118619aa75d5f92fac648f34c0cd74fd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\118619aa75d5f92fac648f34c0cd74fd.dll",DllRegisterServer
    3⤵
    PID:1656

memory/744-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download

memory/1864-55-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/1864-56-0x0000000000200000-0x0000000000227000-memory.dmp

Download