emotet | 3932d171872a482e4e664644292f80c284d7a9e8919aaa9e6820f34d4cd9c7e6

Analysis

Target
8732f104a805dd2047f337efbd024657.dll
Size 536KB
Sample220128-wjk9sshgfp
SHA256 3932d171872a482e4e664644292f80c284d7a9e8919aaa9e6820f34d4cd9c7e6
MD5 8732f104a805dd2047f337efbd024657
SHA1 7b6781e1e5a07a0af44dd930acb1045099532635
SHA512 e4217c0ffcd7671429e81388b23ece62e57f9261dacece86ee2717e3d4fb77547bc9adb9f54e9fb9b8532a9cc4443660178aa0a03d744f8b68783a6a5b9ec916
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 1944 wrote to memory of 2040	1944	regsvr32.exe	27
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28
PID 2040 wrote to memory of 336	2040	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll",DllRegisterServer
    3⤵
    PID:336

memory/1944-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download

memory/2040-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/2040-57-0x0000000000470000-0x0000000000495000-memory.dmp

Download