emotet | 75b34be63e2a8e569531b9e9ba5abb4ef5d32d9eaa8159d1b19f3fac341f73c5

Analysis

Target
parse.dll
Size 596KB
Sample220128-l5mpmsbfa3
SHA256 75b34be63e2a8e569531b9e9ba5abb4ef5d32d9eaa8159d1b19f3fac341f73c5
MD5 9d3590974f289d0237dabd9eecbbcb10
SHA1 89a59e4874385e0db03cbafef885b429d87462ba
SHA512 633c07e868c4eec09e667b70a859a97dec633980cda9a379407149d06a03ff3f8c24d8b92afdf3ae617c9e026fe77db84eee72738b39d7ecaae1e5454d8a39d2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1108 wrote to memory of 1668	1108	regsvr32.exe	27
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28
PID 1668 wrote to memory of 1688	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\parse.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\parse.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\parse.dll",DllRegisterServer
    3⤵
    PID:1688

memory/1108-53-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download

memory/1668-54-0x0000000075431000-0x0000000075433000-memory.dmp

Download

memory/1668-55-0x0000000000170000-0x0000000000197000-memory.dmp

Download