emotet | cfcd52273d652e79fbc68b25689b964c925494a9557cb759a2ceb45136c8ed11

Analysis

Target
5e3141aaa6d0514e793378190079d422.dll
Size 216KB
Sample220207-tdya3aebcm
SHA256 cfcd52273d652e79fbc68b25689b964c925494a9557cb759a2ceb45136c8ed11
MD5 5e3141aaa6d0514e793378190079d422
SHA1 260d20f06c6a3f56549f16f9d8a47081166dca70
SHA512 3ad81dced6a0ef2158aac931d5d6ae229c3071425865b78e9de3c2b8bdc9ba92cb5c64b61fc2f544c80ee301c990b93b9a9d94cccfef480f1d4ab14801ecdc13
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1600	2016	regsvr32.exe	27
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28
PID 1600 wrote to memory of 1572	1600	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5e3141aaa6d0514e793378190079d422.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5e3141aaa6d0514e793378190079d422.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5e3141aaa6d0514e793378190079d422.dll",DllRegisterServer
    3⤵
    PID:1572

memory/1600-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/1600-56-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/2016-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download