emotet | f6efbb5b796559364e5016928245a130d82b566aec565b558d657c80a120b000

Analysis

Target
https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
Size 496KB
Sample220127-e724safhe5
SHA256 f6efbb5b796559364e5016928245a130d82b566aec565b558d657c80a120b000
MD5 780f2211a20f87760b6f036bc7681370
SHA1 28c61400b05e6a68baad2a517ac820ef03ea4412
SHA512 746ffe8f4b3f7df625631f7931fe128e836bd4c5f1bfcc5e22188539ef772493ff753f31be804b5232f92a1ee4ff95187f23745f837fe8df60097431bc78577c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 288 wrote to memory of 1928	288	regsvr32.exe	27
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28
PID 1928 wrote to memory of 268	1928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:268

memory/288-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download

memory/1928-55-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/1928-57-0x00000000001C0000-0x00000000001E5000-memory.dmp

Download