emotet | c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30

Analysis

Target
c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30.dll
Size 1.0MB
Sample220205-s2hd3sdbbk
SHA256 c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30
MD5 9c8fd012d1ae254238681fd189e781b1
SHA1 dfdfd9f56fed2d3b7ecf3f6db61ba53300111e8e
SHA512 e7fda4c8d683423b5a9bbf77eff2a880043e83103366f9632da5cfe2c94c5a7ff3c6ded4a345a439d798b78f0af5e166a9527716d3a2ac2c47cd060b5e15e938
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 2020 wrote to memory of 1996	2020	regsvr32.exe	27
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28
PID 1996 wrote to memory of 1276	1996	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30.dll",DllRegisterServer
    3⤵
    PID:1276

memory/1996-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1996-56-0x0000000000440000-0x0000000000466000-memory.dmp

Download

memory/2020-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

Download