emotet | 55e36f83adc239d974852e374a27bcfb7cf158aebe78efed4a598bb7c28a154f

Analysis

Target
9ef9d5d06e49e02fe07f83dde4c2a57f.dll
Size 1.1MB
Sample220223-shbgesaed6
SHA256 55e36f83adc239d974852e374a27bcfb7cf158aebe78efed4a598bb7c28a154f
MD5 9ef9d5d06e49e02fe07f83dde4c2a57f
SHA1 a0f76b24c3ce96bf80d0d37fb59c8cefd6d98f33
SHA512 aedbfeee4f9403e10ac3310d39d973434ed82e2b66484c7638ee1c1a3fff41ef6ebc94aa6babf28029b190488f4070aa476b27f1f0c3fc6ae0065a553878e64d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Suixnrarzkvsdwyv\bfqld.vhz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
688	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
960	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 1088 wrote to memory of 960	1088	regsvr32.exe	27
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28
PID 960 wrote to memory of 688	960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9ef9d5d06e49e02fe07f83dde4c2a57f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9ef9d5d06e49e02fe07f83dde4c2a57f.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Suixnrarzkvsdwyv\bfqld.vhz"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:688

memory/688-59-0x0000000000250000-0x0000000000275000-memory.dmp

Download

memory/960-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/960-57-0x0000000000230000-0x0000000000255000-memory.dmp

Download

memory/1088-54-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Download