emotet | 3d42da4dcaab7651baeb783c8885c547285320d2af340deefbd0d9a724dbf7d0

Analysis

Target
2d32de10f33975eca2dc8d500a40c526.dll
Size 758KB
Sample220208-thcj6aabem
SHA256 3d42da4dcaab7651baeb783c8885c547285320d2af340deefbd0d9a724dbf7d0
MD5 2d32de10f33975eca2dc8d500a40c526
SHA1 ad6cc0f1329f212e00ad13a9ccda11e9b57b55c8
SHA512 646e6d73c5b4b2269846adaa6c76deb87f1ef54f942c3a253c1c3344808b232496ea6517a127ef922c8717d334ede20c85f85227d850a713bd442547cce2ec11
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 536 wrote to memory of 1580	536	regsvr32.exe	27
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28
PID 1580 wrote to memory of 268	1580	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2d32de10f33975eca2dc8d500a40c526.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2d32de10f33975eca2dc8d500a40c526.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\2d32de10f33975eca2dc8d500a40c526.dll",DllRegisterServer
    3⤵
    PID:268

memory/536-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1580-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1580-57-0x0000000010000000-0x0000000010025000-memory.dmp

Download