emotet | aa10a2dca5d50a240ef9f7823b51dbd27204b1f72e8016904d633703e4074a0a

Analysis

Target
http___unifiedpharma.com_wp-content_5arxM_Wed_Jan_26_10_26_39_PM_CST_2022.dll
Size 504KB
Sample220127-e8v2vsffbm
SHA256 aa10a2dca5d50a240ef9f7823b51dbd27204b1f72e8016904d633703e4074a0a
MD5 373f088aa02724dbfd0f0c401be51643
SHA1 7b364a189422f80398fc7dfd07e0e638b1de1ad9
SHA512 d493bff90d4966d7ea9312c5076247801d994f4b81f72efdda50b95e6c3975cd31ab226ffcfd8d2324ec4734cec361f3a8ff81d3aae82d093c26bf06d5932741
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 3080 wrote to memory of 660	3080	regsvr32.exe	69
PID 660 wrote to memory of 1668	660	regsvr32.exe	70
PID 660 wrote to memory of 1668	660	regsvr32.exe	70
PID 660 wrote to memory of 1668	660	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___unifiedpharma.com_wp-content_5arxM_Wed_Jan_26_10_26_39_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___unifiedpharma.com_wp-content_5arxM_Wed_Jan_26_10_26_39_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___unifiedpharma.com_wp-content_5arxM_Wed_Jan_26_10_26_39_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:1668

memory/660-119-0x0000000000EE0000-0x0000000000F07000-memory.dmp

Download