emotet | e484e6db8d1eb4c44ffc47e495b537af77ef1c7ce64b8079fd656e0b38635705

Analysis

Target
https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
Size 544KB
Sample220128-vdf78ahah8
SHA256 e484e6db8d1eb4c44ffc47e495b537af77ef1c7ce64b8079fd656e0b38635705
MD5 2ddb3f4cb56eade940010050438dfc8a
SHA1 f13b45358caaf228d478bebf549ba1230cbc78ec
SHA512 573a83f149e9c8362e075ce068be6c541b7de1c374042587f9744df1cec4bd86de3af4fcb3738251fceb9a80ace29f7962adb605aa52ff0a89c3accd84be3c11
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1204	1764	regsvr32.exe	68
PID 1764 wrote to memory of 1204	1764	regsvr32.exe	68
PID 1764 wrote to memory of 1204	1764	regsvr32.exe	68
PID 1204 wrote to memory of 2128	1204	regsvr32.exe	69
PID 1204 wrote to memory of 2128	1204	regsvr32.exe	69
PID 1204 wrote to memory of 2128	1204	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___mypurealsystem.com_App_Start_Rhh8lKO_Fri_Jan_28_10_48_15_AM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:2128

memory/1204-119-0x00000000048E0000-0x0000000004907000-memory.dmp

Download