emotet | 46e9737524eea4e1dc8cf866775c67d49b03fd367ca0a83fb8f41502be4b4923

Analysis

Target
CLDD7w.dll
Size 542KB
Sample220131-snf9vshedr
SHA256 46e9737524eea4e1dc8cf866775c67d49b03fd367ca0a83fb8f41502be4b4923
MD5 e49f0165dbb04f04397ab9e5c6361024
SHA1 20c14eb73e6e8fcfe61e180bd4402ae3b13e3fc9
SHA512 734148670f6074167be334987029ceaa03a29ebcf682676dd7a930f5ca3677171618175119e40db6fba31442a26a71491529a3a02dca252460862a1c1e819873
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1748 wrote to memory of 1480	1748	regsvr32.exe	27
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CLDD7w.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CLDD7w.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CLDD7w.dll",DllRegisterServer
    3⤵
    PID:960

memory/1480-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1480-56-0x00000000005E0000-0x0000000000607000-memory.dmp

Download

memory/1748-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download