emotet | 005c988dfba391bb3eb8dddf8b4a747ec65f0ae59810fa55de124c201865b6b3

Analysis

Target
http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
Size 504KB
Sample220127-e724safehr
SHA256 005c988dfba391bb3eb8dddf8b4a747ec65f0ae59810fa55de124c201865b6b3
MD5 ed71b46a6c61d4cf8d035f572dcf8e6a
SHA1 8bf04347f50769a3bcfbd011982cec83f75f45ea
SHA512 378ea6c19dfff791bebd414c8c8628b2715b803eccebd9ec75daae5c3d55a90b45514ed6d4f9528d92b559cdb10f42aff695a72267b3e38f5e4f08a161098eed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1100	1876	regsvr32.exe	27
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28
PID 1100 wrote to memory of 476	1100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:476

memory/1100-56-0x00000000760F1000-0x00000000760F3000-memory.dmp

Download

memory/1100-57-0x00000000003F0000-0x0000000000417000-memory.dmp

Download

memory/1876-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Download