emotet | 6d9a199d529e3dd5243a4332d5c852ab9d06c7edf28bf8cd20977bf59b0a60a5

Analysis

Target
zqG6KlvOPbDTn4x2eI.dll
Size 520KB
Sample220202-jvd9eahgd4
SHA256 6d9a199d529e3dd5243a4332d5c852ab9d06c7edf28bf8cd20977bf59b0a60a5
MD5 544cc134bf0ea46a533c282c94e540ab
SHA1 dcbd5388357e0f45a116fc1dc66a740111dd5b69
SHA512 eac8d741971848746c0ef0d639267949662c1c3c69078a34154ff059bba96ef7fb29fd7b98543b8f0aa6090c0ca03a6fce7a86eb58c22f11ad591709adf1a75e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1516	1564	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\zqG6KlvOPbDTn4x2eI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\zqG6KlvOPbDTn4x2eI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\zqG6KlvOPbDTn4x2eI.dll",DllRegisterServer
    3⤵
    PID:1516

memory/948-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1564-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1564-56-0x0000000000230000-0x0000000000256000-memory.dmp

Download