emotet | a0a334db6f8e0267844765a6b31e806f994b6034b5c8ee2ea0ec00a7b08aee17

Analysis

Target
emotet_exe_e5_a0a334db6f8e0267844765a6b31e806f994b6034b5c8ee2ea0ec00a7b08aee17_2022-02-25__000047.dll
Size 1.0MB
Sample220225-aaz6psfbfr
SHA256 a0a334db6f8e0267844765a6b31e806f994b6034b5c8ee2ea0ec00a7b08aee17
MD5 5507844b9e19555071611385fc747863
SHA1 27529e518dde552b9a257a1245af9592c209e795
SHA512 cb6655b7b8364744bb4d45ef721bcadeb6e73de798ef724c4b8f3082aec2e6d9ed8f365fc4c3921b1397c63a4210ddec8ad3dea17e654e6d1827415a45dcad31
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ikhdpcwdedbt\noqbt.mkp	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
980	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 1104 wrote to memory of 980	1104	regsvr32.exe	27
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28
PID 980 wrote to memory of 1684	980	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a0a334db6f8e0267844765a6b31e806f994b6034b5c8ee2ea0ec00a7b08aee17_2022-02-25__000047.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a0a334db6f8e0267844765a6b31e806f994b6034b5c8ee2ea0ec00a7b08aee17_2022-02-25__000047.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ikhdpcwdedbt\noqbt.mkp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684

memory/980-55-0x0000000075CC1000-0x0000000075CC3000-memory.dmp

Download

memory/980-56-0x0000000000150000-0x0000000000175000-memory.dmp

Download

memory/1104-54-0x000007FEFBA21000-0x000007FEFBA23000-memory.dmp

Download

memory/1684-59-0x00000000005A0000-0x00000000005C5000-memory.dmp

Download