emotet | c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe

Analysis

Target
c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe.dll
Size 977KB
Sample220205-s2hd3sdbbl
SHA256 c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe
MD5 d9ce7f1f5517f0b346805d86c48deae1
SHA1 5cb4e7690f7e396d32bff6eb6bda0256acf085c9
SHA512 fcd406c42e358412ee58ed3f66fec658ac24d970e9e3372fd246f591a657c065340373b32b4163e2a90af703d97390a66ba3739f599f0e04a3f790cd62efca1e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1296 wrote to memory of 1128	1296	regsvr32.exe	27
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28
PID 1128 wrote to memory of 1464	1128	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe.dll",DllRegisterServer
    3⤵
    PID:1464

memory/1128-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1128-56-0x0000000000520000-0x0000000000545000-memory.dmp

Download

memory/1296-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download