emotet | 02bcfe70354190f5950b606661e4f139e17e76bc2f3a9f430ccbd416873733b2

Analysis

Target
kQ5ribC7b1HBE6b.dll
Size 542KB
Sample220131-ssf5naabb7
SHA256 02bcfe70354190f5950b606661e4f139e17e76bc2f3a9f430ccbd416873733b2
MD5 695a5b086ee21c794da2e8f8f338ee34
SHA1 61f234851c318eef3bd7c5fbeaae7a6dc4c96610
SHA512 220f04d7ba4afe31040934414dfb81674d53d37ec1bac72282102249072be423574e96f49874e8334334525b35beccaf9f8371ce0f89605fc4c71a336713a50a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1532 wrote to memory of 1540	1532	regsvr32.exe	27
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28
PID 1540 wrote to memory of 1356	1540	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kQ5ribC7b1HBE6b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kQ5ribC7b1HBE6b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\kQ5ribC7b1HBE6b.dll",DllRegisterServer
    3⤵
    PID:1356

memory/1532-55-0x000007FEFB801000-0x000007FEFB803000-memory.dmp

Download

memory/1540-56-0x0000000074F11000-0x0000000074F13000-memory.dmp

Download

memory/1540-57-0x0000000001DA0000-0x0000000001DC7000-memory.dmp

Download