emotet | ff6282644818311a77ffd536f3166f6546506b8ac3d47ccf7b80aaef6e6607c6

Analysis

Target
https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
Size 496KB
Sample220127-e724safehm
SHA256 ff6282644818311a77ffd536f3166f6546506b8ac3d47ccf7b80aaef6e6607c6
MD5 96a134b7af8fa3ff3f21532962e354aa
SHA1 c533c3e3de6c591905869e180430c026b4e998ad
SHA512 9ab10fedbbd1c879f8e134974580e084af6918675bc31139c2e2b67d375d28b047cdfee7209e0bc73a8f6645149b26f71b46d460e0c259fe190bdb828c151eab
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 1548 wrote to memory of 868	1548	regsvr32.exe	27
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28
PID 868 wrote to memory of 1612	868	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1612

memory/868-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/868-57-0x00000000001F0000-0x0000000000215000-memory.dmp

Download

memory/1548-55-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

Download