emotet | 4bdd69925a34e9cf93b3358bcdfe256c3ce432e4566e66008405b69c19b5b09b

Analysis

Target
04ce93644948231ad1ba5dc8e2144cac.dll
Size 997KB
Sample220204-weksgadcd4
SHA256 4bdd69925a34e9cf93b3358bcdfe256c3ce432e4566e66008405b69c19b5b09b
MD5 04ce93644948231ad1ba5dc8e2144cac
SHA1 8285d2bf9406a63d1023a9e2d92ffcf9d2d9c191
SHA512 f8613c96f3a5daefa7b517bf3a534b520560bb536438a19c82c45e50a9d834bfd3f03a82fc091a0655f166640a2679b640eb82a6bf9bba74b02a353fdf448bcf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1256 wrote to memory of 1328	1256	regsvr32.exe	27
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28
PID 1328 wrote to memory of 972	1328	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04ce93644948231ad1ba5dc8e2144cac.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04ce93644948231ad1ba5dc8e2144cac.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\04ce93644948231ad1ba5dc8e2144cac.dll",DllRegisterServer
    3⤵
    PID:972

memory/1256-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/1328-55-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/1328-56-0x00000000001D0000-0x00000000001F5000-memory.dmp

Download