emotet | 253d80ef0845b87680caf4da3a2053180fdab960d8d27415db3d1f6b8f1ad415

Analysis

Target
da4251601546daf6a4f83140041dae2b.dll
Size 512KB
Sample220127-ss397aehbk
SHA256 253d80ef0845b87680caf4da3a2053180fdab960d8d27415db3d1f6b8f1ad415
MD5 da4251601546daf6a4f83140041dae2b
SHA1 cf134fbe417ab2169d83eefa0441ab10f4796600
SHA512 f43801199517f91236bf78b5ba474706731f603ec2aa569a83e0869fb322a0bacfb4204b22677beb34c0fd6e101fe500f24dd6e333e4d83b4e8a783f43e49a30
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 1736 wrote to memory of 336	1736	regsvr32.exe	27
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28
PID 336 wrote to memory of 476	336	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\da4251601546daf6a4f83140041dae2b.dll",DllRegisterServer
    3⤵
    PID:476

memory/336-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/336-57-0x00000000004D0000-0x00000000004F5000-memory.dmp

Download

memory/1736-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download