emotet | eaf8a59ec22f413eb9f233f605b7ee422c23556c54ebec65173e544204e9f3a9

Analysis

Target
40476cc6f3d51139bafa2e9495554f2e.dll
Size 1.0MB
Sample220204-x2m2saecf5
SHA256 eaf8a59ec22f413eb9f233f605b7ee422c23556c54ebec65173e544204e9f3a9
MD5 40476cc6f3d51139bafa2e9495554f2e
SHA1 2791e8d813984679154274ccdcfc2436b917d5cc
SHA512 6f38bb96fa006502ddeebe8a21c54e78ec9cbd0706ecd98409138e6bf5c9c9af6ca1603b1ff5ec4a377bdd59ecf44b4620c20bb768e35ec2e0ea3eb73808d13a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1444	1092	regsvr32.exe	27
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28
PID 1444 wrote to memory of 1488	1444	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\40476cc6f3d51139bafa2e9495554f2e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\40476cc6f3d51139bafa2e9495554f2e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\40476cc6f3d51139bafa2e9495554f2e.dll",DllRegisterServer
    3⤵
    PID:1488

memory/1092-55-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Download

memory/1444-56-0x0000000075831000-0x0000000075833000-memory.dmp

Download

memory/1444-57-0x0000000000160000-0x0000000000186000-memory.dmp

Download