emotet | ff6282644818311a77ffd536f3166f6546506b8ac3d47ccf7b80aaef6e6607c6

Analysis

Target
https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
Size 496KB
Sample220127-e724safehm
SHA256 ff6282644818311a77ffd536f3166f6546506b8ac3d47ccf7b80aaef6e6607c6
MD5 96a134b7af8fa3ff3f21532962e354aa
SHA1 c533c3e3de6c591905869e180430c026b4e998ad
SHA512 9ab10fedbbd1c879f8e134974580e084af6918675bc31139c2e2b67d375d28b047cdfee7209e0bc73a8f6645149b26f71b46d460e0c259fe190bdb828c151eab
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3632	3540	regsvr32.exe	68
PID 3540 wrote to memory of 3632	3540	regsvr32.exe	68
PID 3540 wrote to memory of 3632	3540	regsvr32.exe	68
PID 3632 wrote to memory of 3040	3632	regsvr32.exe	69
PID 3632 wrote to memory of 3040	3632	regsvr32.exe	69
PID 3632 wrote to memory of 3040	3632	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___tanquessepticos.com_wp-admin_ApVVbl1fQ0_Wed_Jan_26_10_29_15_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:3040

memory/3632-118-0x0000000001350000-0x0000000001375000-memory.dmp

Download