emotet | d8e2daa053304d19a945a23da2cc4f9ddf7cefba86f84a111603c137f32d4147

Analysis

Target
9c551b4e1ff7c74f5baaa6ef10729219.dll
Size 520KB
Sample220201-ynptwsbdf2
SHA256 d8e2daa053304d19a945a23da2cc4f9ddf7cefba86f84a111603c137f32d4147
MD5 9c551b4e1ff7c74f5baaa6ef10729219
SHA1 132e721e8db3a328482380022acd3498f1bdd465
SHA512 13e9d1f2ee6648ef544047384112c798ff356977c04fc7b16a6377e0107e07167d8ba0f68e442c7692175c26fede4e13012d4f674c97803bfbc901bae070a70d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1452	1636	regsvr32.exe	27
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28
PID 1452 wrote to memory of 1100	1452	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9c551b4e1ff7c74f5baaa6ef10729219.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9c551b4e1ff7c74f5baaa6ef10729219.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9c551b4e1ff7c74f5baaa6ef10729219.dll",DllRegisterServer
    3⤵
    PID:1100

memory/1452-55-0x0000000076421000-0x0000000076423000-memory.dmp

Download

memory/1452-56-0x0000000000230000-0x0000000000256000-memory.dmp

Download

memory/1636-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download