emotet | 89a8c9d2aabcbcc8b22fd363c09ef705439ee2bd229703135e4a5ceafaa59531

Analysis

Target
99c909b303ebf89be3a6191cb11fe450.dll
Size 213KB
Sample220207-tknefaecck
SHA256 89a8c9d2aabcbcc8b22fd363c09ef705439ee2bd229703135e4a5ceafaa59531
MD5 99c909b303ebf89be3a6191cb11fe450
SHA1 b8ba65e9c16f9b238e2863a8f41624bcd76bfe69
SHA512 c8a698cc6e3f731f3181cb6e69269ad2b2f2160aa05c683a23d1804e3e877a7eba6f8cc45e77a2b014eb50ae13f631dedeb75ed7a3870a6a251ad07d3d85cbd4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 840 wrote to memory of 1616	840	regsvr32.exe	27
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1524	1616	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\99c909b303ebf89be3a6191cb11fe450.dll",DllRegisterServer
    3⤵
    PID:1524

memory/840-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download

memory/1616-55-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/1616-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download