emotet | 7a36fdbbc5f8bb670b0052e7aef91d9cc8736a9fbf7512b3d6d0a0ced77df438

Analysis

Target
3d0397e15116e15ec1eba61da389cabc.dll
Size 216KB
Sample220207-w4d18afde9
SHA256 7a36fdbbc5f8bb670b0052e7aef91d9cc8736a9fbf7512b3d6d0a0ced77df438
MD5 3d0397e15116e15ec1eba61da389cabc
SHA1 608a8f0e783664e92ae3de95bba223f6dc750d7c
SHA512 6542500fb7fb970fe0252b1e47e02b1271071689fb2fb4e8713412284e13d953510dd2db45c8219de093173b036142a99c7bbc14879ba3e01af007e503c32af0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 1248 wrote to memory of 848	1248	regsvr32.exe	27
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28
PID 848 wrote to memory of 1696	848	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3d0397e15116e15ec1eba61da389cabc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3d0397e15116e15ec1eba61da389cabc.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3d0397e15116e15ec1eba61da389cabc.dll",DllRegisterServer
    3⤵
    PID:1696

memory/848-56-0x00000000758A1000-0x00000000758A3000-memory.dmp

Download

memory/848-57-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/1248-55-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Download