emotet | 0be8de3d3e7d2ad43ed67d469c99716a6cceb7692a799adb79df93b643dd8d03

Analysis

Target
d7d88c5e7baa464538d2db93e8ea97f5.dll
Size 608KB
Sample220208-a6dbtabcfp
SHA256 0be8de3d3e7d2ad43ed67d469c99716a6cceb7692a799adb79df93b643dd8d03
MD5 d7d88c5e7baa464538d2db93e8ea97f5
SHA1 754859e78f83825ad3175a06e6a3b8d79b5e34b9
SHA512 420387f0a7c95ac1a759ecb217ca801823312c5c8d27a526eb1be3a4f3d2bd1d8e37e00ae1366fdde6a76b2506730054a36c70a5800b4b90143f6f336d7eda3e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28
PID 1156 wrote to memory of 460	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d7d88c5e7baa464538d2db93e8ea97f5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d7d88c5e7baa464538d2db93e8ea97f5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d7d88c5e7baa464538d2db93e8ea97f5.dll",DllRegisterServer
    3⤵
    PID:460

memory/1156-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1156-56-0x00000000007C0000-0x00000000007E8000-memory.dmp

Download

memory/1688-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download