emotet | b3d266ade8f88baf7181c7b1f0615edf220f81e2d51da50e78efcf4afab6aba8

Analysis

Target
20db7836693a488b5ce0a6b211cbf5d9.dll
Size 608KB
Sample220208-bkh6lsbecm
SHA256 b3d266ade8f88baf7181c7b1f0615edf220f81e2d51da50e78efcf4afab6aba8
MD5 20db7836693a488b5ce0a6b211cbf5d9
SHA1 58d6c5b3adadb949606164c48739d66de0885701
SHA512 01b2afa40cb55133c252d521c5560b81df7d4d2265ebef1c2ba0a5524f815663a59b75ae5169a42d8f00871f3daa5ca1b3d4560e57a2001a2538256c21d6b042
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1700 wrote to memory of 1552	1700	regsvr32.exe	27
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28
PID 1552 wrote to memory of 1696	1552	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\20db7836693a488b5ce0a6b211cbf5d9.dll",DllRegisterServer
    3⤵
    PID:1696

memory/1552-55-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1552-56-0x0000000000250000-0x0000000000278000-memory.dmp

Download

memory/1700-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download