emotet | 5721f514b0a8e7d0809794ae5f5bebd947238091ab3d553b4f3fcd5e8a113178

Analysis

Target
SS7Qd92T8P99dfFSXw.dll
Size 977KB
Sample220204-ld8g2agedj
SHA256 5721f514b0a8e7d0809794ae5f5bebd947238091ab3d553b4f3fcd5e8a113178
MD5 9d07ec2479621b2015312ea5787788b6
SHA1 69cb9ea65fdd981b12b3f93e91246757561b5b87
SHA512 38c80c9fc984d913581091c4b9df7cbb4b787e885adb0aa4e6a33c6c4259dc74978f3f2a6f9f9dd946ad81e38043e538d3c0ed7f1fb5fff7154076352bb2fde4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1616 wrote to memory of 1596	1616	regsvr32.exe	27
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28
PID 1596 wrote to memory of 1032	1596	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SS7Qd92T8P99dfFSXw.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SS7Qd92T8P99dfFSXw.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SS7Qd92T8P99dfFSXw.dll",DllRegisterServer
    3⤵
    PID:1032

memory/1596-55-0x0000000075531000-0x0000000075533000-memory.dmp

Download

memory/1596-56-0x0000000000210000-0x0000000000235000-memory.dmp

Download

memory/1616-54-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download