emotet | c31e83ad39a2fb74f7a9bccb0f5f5c7b5c346feefb1ca4d34d715247f63a342f

Analysis

Target
gzwA8IdsA8ZV1tcIqdR.dll
Size 544KB
Sample220128-wr28aaach8
SHA256 c31e83ad39a2fb74f7a9bccb0f5f5c7b5c346feefb1ca4d34d715247f63a342f
MD5 8d91a185b12323fb33ff5a5a5557b288
SHA1 5a193df9a7bcaef697692747e5b8bb76badc98a1
SHA512 526d8e1069968a9c5cbb55ef774173eccc80e0100564332916a922b8bac7f2caa68ae508b2ca122c5e08afecb679c43242ea3fb4a3344b397c27007d992e873c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1616	1684	regsvr32.exe	27
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1292	1616	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll",DllRegisterServer
    3⤵
    PID:1292

memory/1616-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1616-58-0x00000000002B0000-0x00000000002D7000-memory.dmp

Download

memory/1684-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download