emotet | 1052142d7f7ffcaabfaf31100eef7e0e88d51ff89aec0463ffd6ac98f83f166c

Analysis

Target
c0253a7e6d6e2f9224fcdf611ec3e30b.dll
Size 504KB
Sample220127-b5v1xaeab2
SHA256 1052142d7f7ffcaabfaf31100eef7e0e88d51ff89aec0463ffd6ac98f83f166c
MD5 c0253a7e6d6e2f9224fcdf611ec3e30b
SHA1 c792cdfe28a90e5d5237d1f8b01dfac7c25bcb0c
SHA512 5ffe902fcdca8d89a0149ba549d4b86a4699582737367a584459a125b820637029049f5bb7fb7ea5c17f56f380b6f8e34d770df9e97e9f15ec443ff3f2dbe47c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 1224 wrote to memory of 368	1224	regsvr32.exe	27
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28
PID 368 wrote to memory of 668	368	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll",DllRegisterServer
    3⤵
    PID:668

memory/368-56-0x0000000075421000-0x0000000075423000-memory.dmp

Download

memory/368-57-0x0000000000760000-0x0000000000787000-memory.dmp

Download

memory/1224-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download