emotet | 603dbb3169c8044ce37937ea05ae454c348e47ef6bbc052f022062f6aff832aa

Analysis

Target
zvb7uw.dll
Size 544KB
Sample220128-wkq7faabe8
SHA256 603dbb3169c8044ce37937ea05ae454c348e47ef6bbc052f022062f6aff832aa
MD5 08f7629d318f73e45a3e1f58808da8eb
SHA1 ff692406150390c314dc86a242ffb3f82c313226
SHA512 b10ad4c4278454c0851df778fef448b2e6232941750eec7c0a089690bf2061e80d3e8807534ddfd7cb070bd57f3959e7aeee5b139495ab267a35fe80408668dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1916 wrote to memory of 1112	1916	regsvr32.exe	27
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28
PID 1112 wrote to memory of 580	1112	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\zvb7uw.dll",DllRegisterServer
    3⤵
    PID:580

memory/1112-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Download

memory/1112-56-0x0000000000500000-0x0000000000527000-memory.dmp

Download

memory/1916-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download