emotet | ae5ff104d538a3404416074e1458cafcce1d08f973f5dacda2e3a0451cbab1fb

Analysis

Target
a370cb268cc76e8915d7c1fac7fe9edf.dll
Size 600KB
Sample220207-22xnfaafgl
SHA256 ae5ff104d538a3404416074e1458cafcce1d08f973f5dacda2e3a0451cbab1fb
MD5 a370cb268cc76e8915d7c1fac7fe9edf
SHA1 ab3c97d48f8e2a37cc0421308d57244d34192be7
SHA512 df31f61a2505e7cd1d1361c8f94b26fb3b1dfac6a7e70f242b84f8d9113ffaa43b67a239312eb3fa914255924b21f5470ffa9b361466bf867bd8732acdcfa195
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1900 wrote to memory of 1224	1900	regsvr32.exe	27
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28
PID 1224 wrote to memory of 672	1224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a370cb268cc76e8915d7c1fac7fe9edf.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a370cb268cc76e8915d7c1fac7fe9edf.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a370cb268cc76e8915d7c1fac7fe9edf.dll",DllRegisterServer
    3⤵
    PID:672

memory/1224-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1224-57-0x0000000000270000-0x0000000000295000-memory.dmp

Download

memory/1900-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download