emotet | aa6d425117f270c921bbd7e75385a23c3372fcee82c0a59fb556c2c2bf09ed7d

Analysis

Target
e52ad05f1e2c8ac5baeaad509f93c866.dll
Size 216KB
Sample220207-w4d18afdf3
SHA256 aa6d425117f270c921bbd7e75385a23c3372fcee82c0a59fb556c2c2bf09ed7d
MD5 e52ad05f1e2c8ac5baeaad509f93c866
SHA1 e7f83d47a1be71c86280944dfe86482ac5bc0653
SHA512 7038a5fe3117ea16527420c87b4bc6a1a94751e5b99a61bdc00de331af51fd10c32a040703a706df18b6d67b88247c2f799cb72c32307260592012a04c26d4d9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 2044 wrote to memory of 1508	2044	regsvr32.exe	27
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28
PID 1508 wrote to memory of 1628	1508	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e52ad05f1e2c8ac5baeaad509f93c866.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e52ad05f1e2c8ac5baeaad509f93c866.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e52ad05f1e2c8ac5baeaad509f93c866.dll",DllRegisterServer
    3⤵
    PID:1628

memory/1508-56-0x0000000075191000-0x0000000075193000-memory.dmp

Download

memory/1508-57-0x0000000010000000-0x0000000010026000-memory.dmp

Download

memory/2044-55-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Download