emotet | db38b97cc093a107c70a428010a4463c2647aff22b7edda6b7a8dff012d71108

Analysis

Target
ad3iKW.dll
Size 977KB
Sample220204-tk8qdaccfr
SHA256 db38b97cc093a107c70a428010a4463c2647aff22b7edda6b7a8dff012d71108
MD5 3154090b9bad479b68579139de11cc4b
SHA1 e86a86d63da1d608723c78c98630ce6f5c957c11
SHA512 7e501e9d82fbc12431d63ea947bfaf44226aa08884938816cf4d5ccbb9f633d95c71c0d27344795a8dbe06fd3ec628052453f1f7e53b5e10640220d1ad951738
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 1836 wrote to memory of 2004	1836	regsvr32.exe	27
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28
PID 2004 wrote to memory of 1968	2004	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad3iKW.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad3iKW.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ad3iKW.dll",DllRegisterServer
    3⤵
    PID:1968

memory/1836-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download

memory/2004-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/2004-57-0x0000000000210000-0x0000000000235000-memory.dmp

Download