emotet | 17f3a0d8dcd9c713daae747caa873d17db3a9212ce7eccb4a02b5347d2adb721

Analysis

Target
5984f17e10df2e1919c667e2c42e78bd.dll
Size 213KB
Sample220207-vaj5psega6
SHA256 17f3a0d8dcd9c713daae747caa873d17db3a9212ce7eccb4a02b5347d2adb721
MD5 5984f17e10df2e1919c667e2c42e78bd
SHA1 b77cb006d2911271f7f36ef3d4b7d67e82ba0c42
SHA512 67583acd9c90254cc827485edd6eaa036fc8ec1c7070380fb0972c7693039fd4d30aadaac0f3d58a67c2bc60c45bf7d230bf48018f87dd6b1f5743790b21249e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1132 wrote to memory of 1188	1132	regsvr32.exe	27
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28
PID 1188 wrote to memory of 1460	1188	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5984f17e10df2e1919c667e2c42e78bd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5984f17e10df2e1919c667e2c42e78bd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5984f17e10df2e1919c667e2c42e78bd.dll",DllRegisterServer
    3⤵
    PID:1460

memory/1132-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1188-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1188-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download