emotet | b8d3085868a57d531bcb5cffcc99d8815c98134c181db3666730203fef012df5

Analysis

Target
2v649dzEDi.dll
Size 536KB
Sample220128-w6mfdaage3
SHA256 b8d3085868a57d531bcb5cffcc99d8815c98134c181db3666730203fef012df5
MD5 30ad5305cf732350ec3fd27b39314a81
SHA1 c865d99ea1b5b7a835a303eff2b6f4ef468d9e82
SHA512 ae0d9dd43029732274bbd741379d93540ef8dbc09205393024f91f11adf34f4f804da71ea3b2a9d4d5c7446e1b586763f7ecec73b9a1b4897e13958cd4358947
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 1592 wrote to memory of 808	1592	regsvr32.exe	27
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28
PID 808 wrote to memory of 524	808	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2v649dzEDi.dll",DllRegisterServer
    3⤵
    PID:524

memory/808-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/808-56-0x00000000001E0000-0x0000000000205000-memory.dmp

Download

memory/1592-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download