emotet | 6168fc4846e868036bce110de02e1dd29a51f2498ebf557b9e48559bcc35a72d

Analysis

Target
1cc1a348a007a67baa038557e0657512.dll
Size 520KB
Sample220201-2be1pscfa9
SHA256 6168fc4846e868036bce110de02e1dd29a51f2498ebf557b9e48559bcc35a72d
MD5 1cc1a348a007a67baa038557e0657512
SHA1 ee89d7c3e96cc7ee0ec008e90e5059da864a6517
SHA512 3c4b249572cf8484716837e7d6ddb1939aa74c05bcac26eae0a1bb8e958541a960ef13a166d8b7b6dd813431f702e275f2750b751a63f1d7d623ab8bf736de77
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1768	1720	regsvr32.exe	27
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28
PID 1768 wrote to memory of 320	1768	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1cc1a348a007a67baa038557e0657512.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1cc1a348a007a67baa038557e0657512.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1cc1a348a007a67baa038557e0657512.dll",DllRegisterServer
    3⤵
    PID:320

memory/1720-53-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download

memory/1768-54-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1768-55-0x00000000009C0000-0x00000000009E6000-memory.dmp

Download