emotet | 005c988dfba391bb3eb8dddf8b4a747ec65f0ae59810fa55de124c201865b6b3

Analysis

Target
http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
Size 504KB
Sample220127-e724safehr
SHA256 005c988dfba391bb3eb8dddf8b4a747ec65f0ae59810fa55de124c201865b6b3
MD5 ed71b46a6c61d4cf8d035f572dcf8e6a
SHA1 8bf04347f50769a3bcfbd011982cec83f75f45ea
SHA512 378ea6c19dfff791bebd414c8c8628b2715b803eccebd9ec75daae5c3d55a90b45514ed6d4f9528d92b559cdb10f42aff695a72267b3e38f5e4f08a161098eed
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4032	3764	regsvr32.exe	69
PID 3764 wrote to memory of 4032	3764	regsvr32.exe	69
PID 3764 wrote to memory of 4032	3764	regsvr32.exe	69
PID 4032 wrote to memory of 4020	4032	regsvr32.exe	70
PID 4032 wrote to memory of 4020	4032	regsvr32.exe	70
PID 4032 wrote to memory of 4020	4032	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___accessunited-bank.com_admin_hzIgVwq8btak_Wed_Jan_26_10_27_24_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:4020

memory/4032-115-0x0000000004C50000-0x0000000004C77000-memory.dmp

Download