emotet | 020e19888d07b4bddc5f0f78dc7857bbd428eaab87295eb82abd3c47fabc1904

Analysis

Target
fe0ac32e757507552901527d22ad11fd.dll
Size 412KB
Sample220131-v4a4wsadep
SHA256 020e19888d07b4bddc5f0f78dc7857bbd428eaab87295eb82abd3c47fabc1904
MD5 fe0ac32e757507552901527d22ad11fd
SHA1 48841a8bda5bb0ffd9d7382c1e48c43afa73cf7b
SHA512 681b394557b022a90eb96623013164febd227ab305a1ea7108805290b74ffe411f4cc9f9a0fd552a59d8fa07b13c2501bcc57ab8c7690a973b082e25db956094
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 1796 wrote to memory of 628	1796	regsvr32.exe	27
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28
PID 628 wrote to memory of 672	628	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fe0ac32e757507552901527d22ad11fd.dll",DllRegisterServer
    3⤵
    PID:672

memory/628-55-0x0000000076C61000-0x0000000076C63000-memory.dmp

Download

memory/628-56-0x0000000000350000-0x0000000000375000-memory.dmp

Download

memory/1796-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download