emotet | dfdb45cfee03882fea7642780ca0b8be0d88ca611a9e434de91025faca06766a

Analysis

Target
ULT8rGY5et4ObI.dll
Size 988KB
Sample220202-x8zddsbccq
SHA256 dfdb45cfee03882fea7642780ca0b8be0d88ca611a9e434de91025faca06766a
MD5 e3e4e904e60d6e6036befd98b98b1ecf
SHA1 990e4280633ae1e22c5766ac32b5d636f718d0e4
SHA512 68c925430ca1961713ac5289986b7e4f5fdcd4df34922a9c926a529fed4b720f5fc10f5531c73ea4c283d9884ebaa7df07cfa68a6b3d928cbe8401860b324843
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 1764 wrote to memory of 768	1764	regsvr32.exe	27
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28
PID 768 wrote to memory of 980	768	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ULT8rGY5et4ObI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ULT8rGY5et4ObI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ULT8rGY5et4ObI.dll",DllRegisterServer
    3⤵
    PID:980

memory/768-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download

memory/768-57-0x0000000000220000-0x0000000000245000-memory.dmp

Download

memory/1764-55-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download