emotet | b3d687704770be364e8a4fd1862f8b1f6073e12fefa469a02e95176b40e4038e

Analysis

Target
contact.dll
Size 642KB
Sample220128-kzge1aagg7
SHA256 b3d687704770be364e8a4fd1862f8b1f6073e12fefa469a02e95176b40e4038e
MD5 0b4614be48ee556c11d14431e9942280
SHA1 52f2ffba601a6d55ff762c01934866d7c3fbe4a5
SHA512 979909aa6f02ec3b95a15bcb122fc3ff5fdd8fca2e11eb89a4cc8dcd4d38167efc11811d432538052826d1706bc6ab346dae48684f7710989f457a9ccec3a824
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1564 wrote to memory of 1588	1564	regsvr32.exe	27
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1288	1588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\contact.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\contact.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\contact.dll",DllRegisterServer
    3⤵
    PID:1288

memory/1564-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/1588-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

Download

memory/1588-57-0x00000000002B0000-0x00000000002D8000-memory.dmp

Download