emotet | c7651f4c7b73652eba42cff05e983b3c45317255010f29aeeb7c561ba4f2aee4

Analysis

Target
6538bab1ab8b2b125fd1bb77accf5667.dll
Size 660KB
Sample220223-299yqsbee8
SHA256 c7651f4c7b73652eba42cff05e983b3c45317255010f29aeeb7c561ba4f2aee4
MD5 6538bab1ab8b2b125fd1bb77accf5667
SHA1 9a34a4ae0131cc94f64ee2ccee8248f76fde2b17
SHA512 e9a6f847a31a3c1463441d2273e5e0a6be94995c2cf011613fcadd1b449ebc9f8b9a056fdba86a9df8a10da5843b6fa0bbe5eb0365ee592e087a594cbbaf94c9
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jsuhtoswmt\wcvhvzzwztemnih.tzh	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
268	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
892	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 756 wrote to memory of 892	756	regsvr32.exe	27
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28
PID 892 wrote to memory of 268	892	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6538bab1ab8b2b125fd1bb77accf5667.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6538bab1ab8b2b125fd1bb77accf5667.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Jsuhtoswmt\wcvhvzzwztemnih.tzh"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:268

memory/268-59-0x0000000000240000-0x0000000000265000-memory.dmp

Download

memory/756-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Download

memory/892-55-0x0000000074E31000-0x0000000074E33000-memory.dmp

Download

memory/892-56-0x0000000000200000-0x0000000000225000-memory.dmp

Download