emotet | eedf3babd3ab614d2c66cf78476ec4c5255acdbd23ba99f43446591c64c3f703

Analysis

Target
rNl.dll
Size 496KB
Sample220127-k97d6sadck
SHA256 eedf3babd3ab614d2c66cf78476ec4c5255acdbd23ba99f43446591c64c3f703
MD5 9b1c12b5076cdfc31303ed067ce906bb
SHA1 fe228230acf0c312150652a050b51576b101e638
SHA512 7b0523753145d008bec82570263d4a38608cebd98e970d22832e694760de11ea81b481ab871bed6ceb2efc97c098098d544873f72e81bc35db49c77b68d3a931
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28
PID 960 wrote to memory of 1820	960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\rNl.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\rNl.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\rNl.dll",DllRegisterServer
    3⤵
    PID:1820

memory/960-55-0x0000000075531000-0x0000000075533000-memory.dmp

Download

memory/960-56-0x0000000000280000-0x00000000002A5000-memory.dmp

Download

memory/1640-54-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download