emotet | af035c2acd5c99634716c81aacbc5f6a4f95f7b6c8eef5a5f446830eb44bc59e

Analysis

Target
0466df035afc1bbcc926c88d3b1825c0.dll
Size 1.0MB
Sample220207-ncmv2sbddk
SHA256 af035c2acd5c99634716c81aacbc5f6a4f95f7b6c8eef5a5f446830eb44bc59e
MD5 0466df035afc1bbcc926c88d3b1825c0
SHA1 423a08f657481f3360f24d5b2f3c386e5e8ebe97
SHA512 e038a04514c973ed8736009db7396101b46b2189b9880eb10509edfdba75e935eadd74820364ef7bcf5da20c10531b0756d4294e5dba6055964ffde0991c0c29
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 876 wrote to memory of 1228	876	regsvr32.exe	27
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28
PID 1228 wrote to memory of 1464	1228	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0466df035afc1bbcc926c88d3b1825c0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0466df035afc1bbcc926c88d3b1825c0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0466df035afc1bbcc926c88d3b1825c0.dll",DllRegisterServer
    3⤵
    PID:1464

memory/876-54-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

Download

memory/1228-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1228-56-0x0000000000200000-0x0000000000226000-memory.dmp

Download