emotet | 092db395fb87ae974dfd357d2be2ab7ab5beb465486c51c1b8f63c6174708525

Analysis

Target
73ef85a8b1030236d6e8f595fc1f1c1c.dll
Size 216KB
Sample220207-rmaj9achdk
SHA256 092db395fb87ae974dfd357d2be2ab7ab5beb465486c51c1b8f63c6174708525
MD5 73ef85a8b1030236d6e8f595fc1f1c1c
SHA1 47ef4af54a0a0968dea7816cc0c6db4258b228bb
SHA512 4849d1d610f19391f751bfce257f0022d01363ffa644b99a8444696ee63b7e6b6364790976f0178db6163b82d6a36d743e2808d3cbd5eef74c50d1f724e5d91e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1240 wrote to memory of 1328	1240	regsvr32.exe	27
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28
PID 1328 wrote to memory of 1620	1328	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73ef85a8b1030236d6e8f595fc1f1c1c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73ef85a8b1030236d6e8f595fc1f1c1c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\73ef85a8b1030236d6e8f595fc1f1c1c.dll",DllRegisterServer
    3⤵
    PID:1620

memory/1240-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download

memory/1328-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/1328-56-0x0000000010000000-0x0000000010026000-memory.dmp

Download