emotet | f6efbb5b796559364e5016928245a130d82b566aec565b558d657c80a120b000

Analysis

Target
https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
Size 496KB
Sample220127-e724safhe5
SHA256 f6efbb5b796559364e5016928245a130d82b566aec565b558d657c80a120b000
MD5 780f2211a20f87760b6f036bc7681370
SHA1 28c61400b05e6a68baad2a517ac820ef03ea4412
SHA512 746ffe8f4b3f7df625631f7931fe128e836bd4c5f1bfcc5e22188539ef772493ff753f31be804b5232f92a1ee4ff95187f23745f837fe8df60097431bc78577c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3700	2688	regsvr32.exe	68
PID 2688 wrote to memory of 3700	2688	regsvr32.exe	68
PID 2688 wrote to memory of 3700	2688	regsvr32.exe	68
PID 3700 wrote to memory of 900	3700	regsvr32.exe	69
PID 3700 wrote to memory of 900	3700	regsvr32.exe	69
PID 3700 wrote to memory of 900	3700	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___umanostudio.com_wp-admin_n1LG7aJnptBlQkC_Wed_Jan_26_10_28_40_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:900

memory/3700-116-0x0000000002AE0000-0x0000000002B05000-memory.dmp

Download