emotet | 6aad5214408f920c7f5a4cc2ac178eaf4db8e8d3e14f07498a6003d614ceef2f

Analysis

Target
E8OwZoQgVkVixEVy8EV.dll
Size 542KB
Sample220131-srdcdaabb3
SHA256 6aad5214408f920c7f5a4cc2ac178eaf4db8e8d3e14f07498a6003d614ceef2f
MD5 dab61fe5ce7e810b784ebb8398278581
SHA1 4c5a35d02f346ab46a602c85159ca76570aad8c4
SHA512 52a4a3e658d8ec260f8dd9d1d3d5dd8bdefe949aab29d31699006f7274209780bda3c5f81742f8200dba9297507650fdd6e4621104dd87f6026e0f7ac27b9b86
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 748 wrote to memory of 1500	748	regsvr32.exe	27
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28
PID 1500 wrote to memory of 332	1500	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E8OwZoQgVkVixEVy8EV.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\E8OwZoQgVkVixEVy8EV.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\E8OwZoQgVkVixEVy8EV.dll",DllRegisterServer
    3⤵
    PID:332

memory/748-54-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Download

memory/1500-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/1500-56-0x00000000007B0000-0x00000000007D7000-memory.dmp

Download