emotet | d4eee453532fd9352cb6164e37a4467ed543f685d66f3fbdf898db26b1b267bc

Analysis

Target
2e26ff85d2cdb74e6f83904bfacf2dbb.dll
Size 504KB
Sample220127-aadmpscfb9
SHA256 d4eee453532fd9352cb6164e37a4467ed543f685d66f3fbdf898db26b1b267bc
MD5 2e26ff85d2cdb74e6f83904bfacf2dbb
SHA1 87d67de603addfce421fe1f5341e0d0b3cf270da
SHA512 d39da85047dfb5d43390c59870dd6dfba1d306c25cf19533f30c0d812768ce88a1e1ab3cd6d5742bd94ba12235a20d09a1273b3152787455c0f4a6cc4a4f3b62
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28
PID 472 wrote to memory of 856	472	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e26ff85d2cdb74e6f83904bfacf2dbb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e26ff85d2cdb74e6f83904bfacf2dbb.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2e26ff85d2cdb74e6f83904bfacf2dbb.dll",DllRegisterServer
    3⤵
    PID:856

memory/472-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/472-57-0x00000000004A0000-0x00000000004C7000-memory.dmp

Download

memory/952-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download