emotet | 8235f6283515ea785e7bd5c94f2b55b192dffb161f4e943e8ac7d1c5dd9a2554

Analysis

Target
Px2.dll
Size 988KB
Sample220203-k2swtafaa9
SHA256 8235f6283515ea785e7bd5c94f2b55b192dffb161f4e943e8ac7d1c5dd9a2554
MD5 8a7ffee4be62c64da7b4293bb7be7cb4
SHA1 bc5787d99064d1cf10688ae454eaa638dafc53ab
SHA512 629a2085692645f9235f71c4fd4dd969e0036dff3e35f07531546a3e0fdf5341ed212e108c391e9c2699e10d2740231d722dbe02df17cf342a0bc4a2ce88ace2
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 1168 wrote to memory of 828	1168	regsvr32.exe	27
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28
PID 828 wrote to memory of 2044	828	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Px2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Px2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Px2.dll",DllRegisterServer
    3⤵
    PID:2044

memory/828-55-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/828-56-0x0000000000470000-0x0000000000495000-memory.dmp

Download

memory/1168-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download