emotet | 6777e8bb18577f7d1798f6d7f4640f81a1968f5ac3ce410ef65f37b94efb3f31

Analysis

Target
17e4107ec67a0241342344bba08a850b.dll
Size 512KB
Sample220127-ss397aehbm
SHA256 6777e8bb18577f7d1798f6d7f4640f81a1968f5ac3ce410ef65f37b94efb3f31
MD5 17e4107ec67a0241342344bba08a850b
SHA1 91f3b67b3946b96d50ec17f946387213f333a275
SHA512 9f60217c1f5e2a9cfa7a8bada5a885c9a380205923710ecdbca4f490dfd17b78be568ea0d693fe9ed144b68f07a556dacb7e1bc53bcfe7f43185f410d1aee0de
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 952 wrote to memory of 472	952	regsvr32.exe	27
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28
PID 472 wrote to memory of 748	472	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll",DllRegisterServer
    3⤵
    PID:748

memory/472-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/472-58-0x0000000000210000-0x0000000000235000-memory.dmp

Download

memory/952-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download