emotet | f8cab823de30c4e5bbacc42c0fc29f575ef6db00cce8b78440542b386543149b

Analysis

Target
129a78193721e612cb12e96a3835e0bd.dll
Size 608KB
Sample220208-a6dbtabdb8
SHA256 f8cab823de30c4e5bbacc42c0fc29f575ef6db00cce8b78440542b386543149b
MD5 129a78193721e612cb12e96a3835e0bd
SHA1 8156eadc22553e6048fb9dc8b415f25848d98fcf
SHA512 b1ed2a8a2112e15864edcd40d4b1087d9f296a0a880ada761367965ae184bd2a373435c5d191a967f9812ac3ee666cdb22b4964e40d897a95144cc2f7d11afc1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 984 wrote to memory of 1648	984	regsvr32.exe	27
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28
PID 1648 wrote to memory of 1328	1648	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\129a78193721e612cb12e96a3835e0bd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\129a78193721e612cb12e96a3835e0bd.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\129a78193721e612cb12e96a3835e0bd.dll",DllRegisterServer
    3⤵
    PID:1328

memory/984-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Download

memory/1648-55-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/1648-57-0x0000000000230000-0x0000000000258000-memory.dmp

Download