emotet | 60bc1a4ea56c7a7574aa28bfb77b4c92532d5a7cc2893bcdc22642f5afe3eb45

Analysis

Target
94475b68548ea5f39875d2d819cc9dc3.dll
Size 758KB
Sample220208-splkzahfc3
SHA256 60bc1a4ea56c7a7574aa28bfb77b4c92532d5a7cc2893bcdc22642f5afe3eb45
MD5 94475b68548ea5f39875d2d819cc9dc3
SHA1 e938550fcda85efcccefaa0ebaee483504d5b7d0
SHA512 b1ac049c1c123effeef8af6df11d942b3b545cd64c6d0131515c50cf4d1a16000f8aeb32923eff81837b72a885f5faa4612682019cba3c90b59880fe805ec51c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1396 wrote to memory of 1712	1396	regsvr32.exe	27
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28
PID 1712 wrote to memory of 516	1712	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\94475b68548ea5f39875d2d819cc9dc3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\94475b68548ea5f39875d2d819cc9dc3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\94475b68548ea5f39875d2d819cc9dc3.dll",DllRegisterServer
    3⤵
    PID:516

memory/1396-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Download

memory/1712-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Download

memory/1712-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download