emotet | e484e6db8d1eb4c44ffc47e495b537af77ef1c7ce64b8079fd656e0b38635705

Analysis

Target
https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
Size 544KB
Sample220128-vdf78ahah8
SHA256 e484e6db8d1eb4c44ffc47e495b537af77ef1c7ce64b8079fd656e0b38635705
MD5 2ddb3f4cb56eade940010050438dfc8a
SHA1 f13b45358caaf228d478bebf549ba1230cbc78ec
SHA512 573a83f149e9c8362e075ce068be6c541b7de1c374042587f9744df1cec4bd86de3af4fcb3738251fceb9a80ace29f7962adb605aa52ff0a89c3accd84be3c11
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 980 wrote to memory of 268	980	regsvr32.exe	27
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28
PID 268 wrote to memory of 672	268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:672

memory/268-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download

memory/268-57-0x00000000001B0000-0x00000000001D7000-memory.dmp

Download

memory/980-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download