emotet | 88e62d810f2a6fc3741d0a2bb54892f656390c7cd3c7de824eae08dba500b3e2

Analysis

Target
73e7745f6b8f0bafa0f646cf57d54d71.dll
Size 516KB
Sample220228-29pb2afcf3
SHA256 88e62d810f2a6fc3741d0a2bb54892f656390c7cd3c7de824eae08dba500b3e2
MD5 73e7745f6b8f0bafa0f646cf57d54d71
SHA1 1d8023f6975b74e624aed006f91665d18de180e1
SHA512 f2817ba8adbdaa1935f47ce55565adbca2cdb31b9d503b14d91799dce29d19390e7a93d9d3fc79184ef2b27be1ea9038a6935c835a31c8d7a675edb18f40e73d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bvksjzvbsxhnwsk\xnnllufatgbxjm.ehm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
776	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
600	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 1652 wrote to memory of 600	1652	regsvr32.exe	27
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28
PID 600 wrote to memory of 776	600	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73e7745f6b8f0bafa0f646cf57d54d71.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73e7745f6b8f0bafa0f646cf57d54d71.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bvksjzvbsxhnwsk\xnnllufatgbxjm.ehm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:776

memory/600-55-0x0000000075811000-0x0000000075813000-memory.dmp

Download

memory/600-56-0x0000000000480000-0x00000000004A7000-memory.dmp

Download

memory/776-59-0x00000000008C0000-0x00000000008E7000-memory.dmp

Download

memory/1652-54-0x000007FEFC231000-0x000007FEFC233000-memory.dmp

Download