emotet | 296477e293c9b956534f7bb33d9a14cd31f43c397cc5a9398d688c66d48e45e3

Analysis

Target
b85e7c6ac7d20d95e7e7f76dbf547994.dll
Size 1.0MB
Sample220207-pg9faaccb9
SHA256 296477e293c9b956534f7bb33d9a14cd31f43c397cc5a9398d688c66d48e45e3
MD5 b85e7c6ac7d20d95e7e7f76dbf547994
SHA1 59cb2a2a6fcef6f922e21813cc8e37f81961dd50
SHA512 92b5a531f9e48de22d696e12934318eec940087b53ac7f11c438716024b3757a458903f94d4ce042e5dc1b6f94924a001afaee4224a92d7dcf92d29d38cd4291
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1616	1072	regsvr32.exe	27
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28
PID 1616 wrote to memory of 744	1616	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b85e7c6ac7d20d95e7e7f76dbf547994.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b85e7c6ac7d20d95e7e7f76dbf547994.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b85e7c6ac7d20d95e7e7f76dbf547994.dll",DllRegisterServer
    3⤵
    PID:744

memory/1072-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download

memory/1616-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1616-57-0x0000000000150000-0x0000000000176000-memory.dmp

Download