emotet | b5a1d88da05709d7452f5d8ee8fdb88d21b844dcc2cbaba9030807b69927fb21

Analysis

Target
b9b53bcfdbac3db46fede93944763058.dll
Size 608KB
Sample220208-bcn2wsbdem
SHA256 b5a1d88da05709d7452f5d8ee8fdb88d21b844dcc2cbaba9030807b69927fb21
MD5 b9b53bcfdbac3db46fede93944763058
SHA1 96e8537ebcf3ce5a924c8b5e9aab57b2ef39a5c1
SHA512 8f1f9c02b9a7fb5e920e0cc63194c3503b614b8c7ac6af6aeac76a0d7378508335caa498cfa95154e7dd36db6da52c953790833d2b429b31046512f8bf688094
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1588 wrote to memory of 1280	1588	regsvr32.exe	27
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28
PID 1280 wrote to memory of 940	1280	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b9b53bcfdbac3db46fede93944763058.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b9b53bcfdbac3db46fede93944763058.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b9b53bcfdbac3db46fede93944763058.dll",DllRegisterServer
    3⤵
    PID:940

memory/1280-56-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1280-57-0x0000000000690000-0x00000000006B8000-memory.dmp

Download

memory/1588-55-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download