emotet | 5afe9ceed5b1621f8e7ec220ce552b11acd274df677dd7dd1aacfef671039832

Analysis

Target
aW58sHsS3ViXbreO.dll
Size 252KB
Sample220202-lssecshfdj
SHA256 5afe9ceed5b1621f8e7ec220ce552b11acd274df677dd7dd1aacfef671039832
MD5 0dacd06cbd01a91fcd605d02fb2b8631
SHA1 54eebe43f74e5015d0db2845c58dc7939a8778db
SHA512 d401269cf8004e86bd9b3700a6441bbea862b7ba7874cdf1e3e3e6d0fd304005d65b52e2b4bf586cb6d9a2db798f93837b67bbc968f32eed8ed48c6cc4de3d5d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1388 wrote to memory of 1572	1388	regsvr32.exe	27
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28
PID 1572 wrote to memory of 1516	1572	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aW58sHsS3ViXbreO.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aW58sHsS3ViXbreO.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\aW58sHsS3ViXbreO.dll",DllRegisterServer
    3⤵
    PID:1516

memory/1388-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download

memory/1572-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1572-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download