emotet | cdb7487cd4094876e9a78de1b7fcc1149d5daa3971fe030d273c2e535d145498

Analysis

Target
http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
Size 504KB
Sample220127-e8b9raffap
SHA256 cdb7487cd4094876e9a78de1b7fcc1149d5daa3971fe030d273c2e535d145498
MD5 cb2f335cd4ef45c5911aefb845c017f4
SHA1 e7b1dac4ef472bd7c0f441545f3dcc02f8c6f9e1
SHA512 ae1e7879cc2c35deef0d26664f064bc0f7cbdbf25014a008704c6129a9e3465adf0be60d46c02db08a10d319c70fe54303c31e453573573efb22dc74bb8cdee0
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 1472 wrote to memory of 308	1472	regsvr32.exe	27
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28
PID 308 wrote to memory of 1596	308	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1596

memory/308-54-0x0000000076491000-0x0000000076493000-memory.dmp

Download

memory/308-55-0x0000000000280000-0x00000000002A7000-memory.dmp

Download

memory/1472-53-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Download