emotet | cc4d30dc1067731d26c138bb4a355c182526e9bfee186d330963389716ddbf99

Analysis

Target
82cdf76be03abadb212593a62e2027dd.dll
Size 977KB
Sample220204-twddlsccg7
SHA256 cc4d30dc1067731d26c138bb4a355c182526e9bfee186d330963389716ddbf99
MD5 82cdf76be03abadb212593a62e2027dd
SHA1 ddc493661dcdcc3397def7287b7f47304e265df5
SHA512 6f923e2600c95ffeb53f4c1f980a114cd582aef8a8b917d8ed97da6a5a12db084c54f3f9489f4f25e34fd3a459feb44d855bde25e953c326d296cb343ac02a98
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1064 wrote to memory of 1500	1064	regsvr32.exe	27
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28
PID 1500 wrote to memory of 1640	1500	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\82cdf76be03abadb212593a62e2027dd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\82cdf76be03abadb212593a62e2027dd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\82cdf76be03abadb212593a62e2027dd.dll",DllRegisterServer
    3⤵
    PID:1640

memory/1064-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1500-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/1500-58-0x0000000000430000-0x0000000000455000-memory.dmp

Download