emotet | 61a28bfafbee458f5364eaa699571f21e2e2a795f6ad09cf2602e2f94a9215c9

Analysis

Target
http___hotelamerpalace.com_Fox-C404_LEPqPJpt4Gbr8BHAn_Wed_Jan_26_07_32_27_PM_CST_2022.dll
Size 504KB
Sample220127-b2e6aadhd9
SHA256 61a28bfafbee458f5364eaa699571f21e2e2a795f6ad09cf2602e2f94a9215c9
MD5 b65fc9fde3e62ee9f622d7f4354818da
SHA1 d7ee22f3950d23431e6f980dc7ad15a0cb466981
SHA512 55d583fb8502ad70362b456900016b7d6556e7a7de3a200d8f67145fd83e20700a5e9b7c25d1b37b081cd5da6891f63dc000b933ab43331aa78c492cc4c9d4d1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1692 wrote to memory of 1792	1692	regsvr32.exe	27
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28
PID 1792 wrote to memory of 1452	1792	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___hotelamerpalace.com_Fox-C404_LEPqPJpt4Gbr8BHAn_Wed_Jan_26_07_32_27_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___hotelamerpalace.com_Fox-C404_LEPqPJpt4Gbr8BHAn_Wed_Jan_26_07_32_27_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___hotelamerpalace.com_Fox-C404_LEPqPJpt4Gbr8BHAn_Wed_Jan_26_07_32_27_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1452

memory/1692-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/1792-55-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/1792-56-0x00000000006F0000-0x0000000000717000-memory.dmp

Download