emotet | 3b4c3a79cbc168c5dc6efea053b2a25be77e32d74e7fcbf5f6ce8e97af58eb00

Analysis

Target
77bf4a34bb5505df191b4edf277b55e6.dll
Size 1.1MB
Sample220223-seh24aaec4
SHA256 3b4c3a79cbc168c5dc6efea053b2a25be77e32d74e7fcbf5f6ce8e97af58eb00
MD5 44649a627856be4b9bfd91d142640f75
SHA1 d866131fbf2dc4b4c944fc38fbacfe0df34d7839
SHA512 87f65550836b853cef97ea1b23b330fc867eb671823c5ac42934c6cce1177e748c87a81afbde58471ceb0cc243152de2fcf75e2632186997b3c4d17711088754
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Yuikgqb\rovwixc.ufm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1500	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1832	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1832	1824	regsvr32.exe	27
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28
PID 1832 wrote to memory of 1500	1832	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77bf4a34bb5505df191b4edf277b55e6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77bf4a34bb5505df191b4edf277b55e6.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Yuikgqb\rovwixc.ufm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500

memory/1824-54-0x000007FEFB981000-0x000007FEFB983000-memory.dmp

Download

memory/1832-55-0x0000000075251000-0x0000000075253000-memory.dmp

Download

memory/1832-56-0x0000000000220000-0x0000000000245000-memory.dmp

Download