emotet | 0556ef8fe8499a20c0b5dd9b0c35940d3e34b4e17bcf88b245f70297a165a911

Analysis

Target
http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
Size 784KB
Sample220127-e8ckhsffbk
SHA256 0556ef8fe8499a20c0b5dd9b0c35940d3e34b4e17bcf88b245f70297a165a911
MD5 00d9be07527d9fcab7812ff67556e359
SHA1 5d3ec73ea02dee17e270afca78886d7bdc6160b3
SHA512 70fe54386a1988a5840932cd53ce5565421454efaa736b925f8852f24baa79c4739ff5660b3af18e13054cf03c1f75a34389a7692c7e3ea8a92e93e09d211d20
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 536 wrote to memory of 1616	536	regsvr32.exe	27
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28
PID 1616 wrote to memory of 776	1616	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:776

memory/536-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1616-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1616-57-0x0000000000320000-0x0000000000347000-memory.dmp

Download