emotet | 296e2b5642a0dc4613c8e30c7ff1fddbb6993b998a385ccab320cefa1dd67230

Analysis

Target
b34fc260ead1a09f0cf0a1dbd4976722.dll
Size 629KB
Sample220128-kd64jaade5
SHA256 296e2b5642a0dc4613c8e30c7ff1fddbb6993b998a385ccab320cefa1dd67230
MD5 b34fc260ead1a09f0cf0a1dbd4976722
SHA1 eec89c043cbbbd1a923e02a21af0a1c61129f298
SHA512 30d1637fcc2ee27dce28eb486ee541235a3ba83fe7c98b122d150e3a5c5963b8dfc6fb40f6c573a8513770bb7308697e32634abf7da6ebaace16811896931304
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll",DllRegisterServer
    3⤵
    PID:1452

memory/1692-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/1792-55-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/1792-56-0x0000000000220000-0x0000000000245000-memory.dmp

Download