emotet | e1598ba48c2c2ee8a98c1ed90686d979c4cb3bf09bce0a7a0a91626fe70acaec

Analysis

Target
1bcfa1998f28225b23801e7272cc3220.dll
Size 213KB
Sample220207-vh137aehd4
SHA256 e1598ba48c2c2ee8a98c1ed90686d979c4cb3bf09bce0a7a0a91626fe70acaec
MD5 1bcfa1998f28225b23801e7272cc3220
SHA1 68fd99944a0f92345811fd68f565b54eeff82ef7
SHA512 a092c23905d9e0abd2cb77280c6f6781edc39f351d191f47a7951e45879c2662d0bcf21301da608de2cb4cc9bb95180b6d12a4110bbf8d80ae11fa7449f94b66
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1608	2036	regsvr32.exe	27
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28
PID 1608 wrote to memory of 984	1608	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bcfa1998f28225b23801e7272cc3220.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1bcfa1998f28225b23801e7272cc3220.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1bcfa1998f28225b23801e7272cc3220.dll",DllRegisterServer
    3⤵
    PID:984

memory/1608-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Download

memory/1608-56-0x0000000010000000-0x0000000010025000-memory.dmp

Download

memory/2036-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Download