emotet | d29e46337fd18cee8d8735e5399bfa62caec5d39f44330470b8aca0d4d276866

Analysis

Target
aa1207cc2c9dd358e1711c02250384c0.dll
Size 1.0MB
Sample220225-kh522affb6
SHA256 d29e46337fd18cee8d8735e5399bfa62caec5d39f44330470b8aca0d4d276866
MD5 aa1207cc2c9dd358e1711c02250384c0
SHA1 d1a70620d93db75af44e12e52ff6bf1f35c19d2f
SHA512 c14707f451cdc94bb112e8131f40bd1dee702bffa015082826e80dcfaf0a590202b8a25dbd9a6e3a20f1b21d7a85a2c1350c0260a09414bdc13f04ddf0536623
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ubqyir\zfwvye.psb	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1016	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
524	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 1940 wrote to memory of 524	1940	regsvr32.exe	27
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28
PID 524 wrote to memory of 1016	524	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa1207cc2c9dd358e1711c02250384c0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aa1207cc2c9dd358e1711c02250384c0.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ubqyir\zfwvye.psb"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1016

memory/524-55-0x0000000076271000-0x0000000076273000-memory.dmp

Download

memory/524-56-0x00000000002A0000-0x00000000002C5000-memory.dmp

Download

memory/1016-59-0x00000000002E0000-0x0000000000305000-memory.dmp

Download

memory/1940-54-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Download