emotet | 2878f0f1d42e5cce2a201e686c2f77dae81ea5a44327e2cfc5a9cf103f29c7fa

Analysis

Target
j9hjjKPJde.dll
Size 544KB
Sample220128-wr28aaach7
SHA256 2878f0f1d42e5cce2a201e686c2f77dae81ea5a44327e2cfc5a9cf103f29c7fa
MD5 fcbbbb755e1db653176d93b8b652d88f
SHA1 8805bdcf841b17bfad76729bc81d0261a75c46fc
SHA512 9f318419960fb3151541648ebe170f53bb90e41ef14f5d5497fec0c027127cf68d9a18965270815f7d6b3462070eeee7df14658a65df269eb376be882f1d5b10
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 956 wrote to memory of 1328	956	regsvr32.exe	27
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28
PID 1328 wrote to memory of 756	1328	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll",DllRegisterServer
    3⤵
    PID:756

memory/956-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download

memory/1328-55-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/1328-56-0x00000000001A0000-0x00000000001C7000-memory.dmp

Download