emotet | 71ccc4f0c21332e6f3e5c50fcb6e7987b6578df8411dfd9271860a8af5d2c273

Analysis

Target
a580d6aafe87e22f8f2367a6e4b59bd7.dll
Size 216KB
Sample220207-w4d18afcgp
SHA256 71ccc4f0c21332e6f3e5c50fcb6e7987b6578df8411dfd9271860a8af5d2c273
MD5 a580d6aafe87e22f8f2367a6e4b59bd7
SHA1 dd7cad8985fb3bae0d121dc0bd0396f4e0bf25ab
SHA512 fd386d5743762b5cfd9779984e70b391e43f5fe92121e341657bfac7469c02529c60b3171ae6d477a61c332d243d1b787350dd930136f8c862a668ae1073b4fd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 2032 wrote to memory of 1336	2032	regsvr32.exe	27
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28
PID 1336 wrote to memory of 1588	1336	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a580d6aafe87e22f8f2367a6e4b59bd7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a580d6aafe87e22f8f2367a6e4b59bd7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\a580d6aafe87e22f8f2367a6e4b59bd7.dll",DllRegisterServer
    3⤵
    PID:1588

memory/1336-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1336-56-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/2032-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download