emotet | c7a8dc4daf9daa53e7995b6dc9403aa01255da1cafdc837f16f7eaa04d409a3e

Analysis

Target
27acb1da5e6a0d09318bd956722887b1.dll
Size 979KB
Sample220203-s5xceabbf4
SHA256 c7a8dc4daf9daa53e7995b6dc9403aa01255da1cafdc837f16f7eaa04d409a3e
MD5 27acb1da5e6a0d09318bd956722887b1
SHA1 524acee7a7993512b5a7e4711d7f6be7ab1eb005
SHA512 297a06e29d6731fbfc01f51e4255c3731faf6bff25e4a124d9853b6867a926232f0430b5394391fe7d8f0362bce9f3aa65dae66d7bfe5ab67614e030120acb22
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1652 wrote to memory of 1532	1652	regsvr32.exe	27
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1832	1532	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\27acb1da5e6a0d09318bd956722887b1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\27acb1da5e6a0d09318bd956722887b1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\27acb1da5e6a0d09318bd956722887b1.dll",DllRegisterServer
    3⤵
    PID:1832

memory/1532-55-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/1532-56-0x00000000002F0000-0x0000000000316000-memory.dmp

Download

memory/1652-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download