emotet | 325d29ab61a19e2906948e76dc7e43b6307df34165d6a86ebbc960563d37d0ce

Analysis

Target
366af6454924b2e4c91bb6d1a8ae23ab.dll
Size 536KB
Sample220128-wjk9sshgfm
SHA256 325d29ab61a19e2906948e76dc7e43b6307df34165d6a86ebbc960563d37d0ce
MD5 366af6454924b2e4c91bb6d1a8ae23ab
SHA1 16c844c96508859dccc1625388779d79eb05c544
SHA512 828b67da57993a382d0d792c53319ce398a5c59c5bb59bad3f818815cb811e92ad8aa572f29ef9b86264f4cfab34188fa36352647e5c7fe6397349fc5534bce9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 840 wrote to memory of 1668	840	regsvr32.exe	27
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28
PID 1668 wrote to memory of 544	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\366af6454924b2e4c91bb6d1a8ae23ab.dll",DllRegisterServer
    3⤵
    PID:544

memory/840-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Download

memory/1668-55-0x0000000076491000-0x0000000076493000-memory.dmp

Download

memory/1668-57-0x0000000000250000-0x0000000000275000-memory.dmp

Download