emotet | cbce9edcf7e58a0e502e2eeb4f528d2bc18ba956699b1140b8beeb974637201f

Analysis

Target
f13356257a8ef932e65ef0f2e5b3b80e.dll
Size 982KB
Sample220203-yybd9addgl
SHA256 cbce9edcf7e58a0e502e2eeb4f528d2bc18ba956699b1140b8beeb974637201f
MD5 f13356257a8ef932e65ef0f2e5b3b80e
SHA1 2d0c6e0ec8a20a9c66b804de9bc588bd8fbd7db5
SHA512 e4c3fab6205abbf8db424536bdda165eba84e57b758fd67e86f528648ae79a49098c8fdab122d9bff8c07bf4b21b553129225248959c9b85debfb0e9224b5770
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	27
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28
PID 1180 wrote to memory of 1880	1180	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f13356257a8ef932e65ef0f2e5b3b80e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f13356257a8ef932e65ef0f2e5b3b80e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f13356257a8ef932e65ef0f2e5b3b80e.dll",DllRegisterServer
    3⤵
    PID:1880

memory/612-55-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download

memory/1180-56-0x0000000076921000-0x0000000076923000-memory.dmp

Download

memory/1180-57-0x0000000000210000-0x0000000000290000-memory.dmp

Download