emotet | 60ec6c4dc4216a9e5e58937ee91fecb9d8286ca471dfb0a30e4a90d77bc8d39b

Analysis

Target
e7712e0cea86f9c80b7e65471e01e901.dll
Size 638KB
Sample220128-kd64jaade7
SHA256 60ec6c4dc4216a9e5e58937ee91fecb9d8286ca471dfb0a30e4a90d77bc8d39b
MD5 e7712e0cea86f9c80b7e65471e01e901
SHA1 fb64995ca94783bfe893295cebab60909a0a3828
SHA512 c94ee6e7235addd9146593f6af422d23fdc92dc113880ef0638096f91cd7912b6333ec767946b1d3c2a57f00d108ea2673569f5fe460ef2f075b49c38eb9a2b8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 820 wrote to memory of 516	820	regsvr32.exe	27
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28
PID 516 wrote to memory of 716	516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll",DllRegisterServer
    3⤵
    PID:716

memory/516-56-0x0000000075191000-0x0000000075193000-memory.dmp

Download

memory/516-57-0x0000000000740000-0x0000000000767000-memory.dmp

Download

memory/820-55-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download