emotet | c34eddcf417afa6db0c2ec7695799df3e132c57e88d0c92070b50c56148b44e2

Analysis

Target
f6e3f1392a33020455f489bddb83d3ab.dll
Size 412KB
Sample220131-vs7cysaccr
SHA256 c34eddcf417afa6db0c2ec7695799df3e132c57e88d0c92070b50c56148b44e2
MD5 f6e3f1392a33020455f489bddb83d3ab
SHA1 cb076cc2223782b3173c13623c0440e78964f561
SHA512 c72e5d94efe47bd6d107a0c09df39f2ce1cc5eaf23c7dc70b835b253df2aed5e61afb01b329577c58bef99b2fdbe7d8349014565bd2f4d8396047b690414ad78
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1624 wrote to memory of 1204	1624	regsvr32.exe	27
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28
PID 1204 wrote to memory of 2040	1204	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f6e3f1392a33020455f489bddb83d3ab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f6e3f1392a33020455f489bddb83d3ab.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f6e3f1392a33020455f489bddb83d3ab.dll",DllRegisterServer
    3⤵
    PID:2040

memory/1204-56-0x0000000076641000-0x0000000076643000-memory.dmp

Download

memory/1204-57-0x00000000001F0000-0x0000000000215000-memory.dmp

Download

memory/1624-55-0x000007FEFC401000-0x000007FEFC403000-memory.dmp

Download