emotet | 97f0b9245e5efc10b580b358768f86d64fe39e4e47b1dd89beeaf2cca46ef3df

Analysis

Target
0765cb8138001f849b50e287ac3a01b3.dll
Size 966KB
Sample220204-twddlscebj
SHA256 97f0b9245e5efc10b580b358768f86d64fe39e4e47b1dd89beeaf2cca46ef3df
MD5 0765cb8138001f849b50e287ac3a01b3
SHA1 000ec61081500b852f2647884047a8c176ca7136
SHA512 ab8a312af8b180efb9cad650e2dda22fc461b110ec0b03f8bc80f017adb265ccac6615c8c53283c6b03af4f01271c326e278810d31de0fea8b00affbeda6b226
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 2040 wrote to memory of 1336	2040	regsvr32.exe	27
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1596	1336	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0765cb8138001f849b50e287ac3a01b3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0765cb8138001f849b50e287ac3a01b3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0765cb8138001f849b50e287ac3a01b3.dll",DllRegisterServer
    3⤵
    PID:1596

memory/1336-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1336-56-0x0000000000260000-0x0000000000286000-memory.dmp

Download

memory/2040-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download