emotet | 11f032d17ba2f8d8a02e3ed412e8c5e96c15d45cc3daa92ee2d23ec33be52d1b

Analysis

Target
74f3c0ba669c5784d0456e438b94d28c.dll
Size 504KB
Sample220127-rezjeadhfm
SHA256 11f032d17ba2f8d8a02e3ed412e8c5e96c15d45cc3daa92ee2d23ec33be52d1b
MD5 74f3c0ba669c5784d0456e438b94d28c
SHA1 f1730a1ff2464cdc636ad8b89d5c82b84d078524
SHA512 3e830ee3859bcb1868496e4e0b6efb85959a26d830b0e82326ada6c6685db394ade3cd53f0bb3e2fe188dff93eae710f73d53cffda6433a979512ed1bdb931e6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 1172 wrote to memory of 268	1172	regsvr32.exe	27
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28
PID 268 wrote to memory of 724	268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll",DllRegisterServer
    3⤵
    PID:724

memory/268-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/268-56-0x00000000007F0000-0x0000000000817000-memory.dmp

Download

memory/1172-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Download