emotet | a3f0d1495a05e655d4950c1d2d7ebf54fd84f13ffad5c364f8a38e54704bba0b

Analysis

Target
dwd1.dll
Size 1.0MB
Sample220207-nc76zsbeh3
SHA256 a3f0d1495a05e655d4950c1d2d7ebf54fd84f13ffad5c364f8a38e54704bba0b
MD5 2273f404ae8bdbf75871f564e6fa956e
SHA1 849578c92940ba014ddf87a2b734584517c12628
SHA512 32d4be280eefdc720b921bc92a0866dbfb656ea0eea358c801a6a59fa6c8ba863f9568350b3d8f0e813e5218d856b6fd234f018ce9c79bd7c9860c8987833e0b
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 964 wrote to memory of 1656	964	regsvr32.exe	27
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28
PID 1656 wrote to memory of 1160	1656	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dwd1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dwd1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dwd1.dll",DllRegisterServer
    3⤵
    PID:1160

memory/964-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Download

memory/1656-55-0x0000000075891000-0x0000000075893000-memory.dmp

Download

memory/1656-56-0x00000000001F0000-0x0000000000270000-memory.dmp

Download