emotet | f2b1089f184ee7ac63c057b7fe42e9d2032f5673caafbcdfd5786a4ff8afd0f0

Analysis

Target
3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
Size 496KB
Sample220127-ced55sebf4
SHA256 f2b1089f184ee7ac63c057b7fe42e9d2032f5673caafbcdfd5786a4ff8afd0f0
MD5 3c62b3b7dcfb151b9f41f4eb38bfe7f9
SHA1 3827e26e11a8c9923f4ab42c421398d832de25c9
SHA512 22831183edef98e24efda285acb67168ed04afb6b789813c1029284142dec6933c8e2ab26051413fd45d25e5fe77bf12122f6b229c1892a4ec383bd40e34a73a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	27
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28
PID 1516 wrote to memory of 1508	1516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll",DllRegisterServer
    3⤵
    PID:1508

memory/1516-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1516-57-0x0000000000270000-0x0000000000295000-memory.dmp

Download

memory/1572-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download