emotet | 59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f

Analysis

Target
emotet_exe_e5_59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f_2022-02-24__000238.dll
Size 660KB
Sample220224-ab3m8abfe4
SHA256 59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f
MD5 138a9555ad78824393878d21269bb69e
SHA1 fde5939c9a28c1afddcae9433877214ea9716118
SHA512 296393591ab114d1e8528eeef2bac7662ce8d60348e55aa6bd5653f0b5740e32ad8479046e62baa0ad2856b1f4c160af4dd255dc1635851ebf70766990e2d0d4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Upemxfveuend\pmtnxj.cfu	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
968	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 316 wrote to memory of 968	316	regsvr32.exe	27
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28
PID 968 wrote to memory of 1092	968	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f_2022-02-24__000238.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f_2022-02-24__000238.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Upemxfveuend\pmtnxj.cfu"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1092

memory/316-54-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Download

memory/968-55-0x0000000076761000-0x0000000076763000-memory.dmp

Download

memory/968-56-0x00000000005D0000-0x00000000005F5000-memory.dmp

Download

memory/1092-59-0x00000000004B0000-0x00000000004D5000-memory.dmp

Download