emotet | 8d21adc1f07c80566794e4bd86e82c63fa79edf1ad9a0523bd0559ead2f09863

Analysis

Target
dc2d4cec94e456055a4968aac89503d9.dll
Size 488KB
Sample220301-2xt2rabge3
SHA256 8d21adc1f07c80566794e4bd86e82c63fa79edf1ad9a0523bd0559ead2f09863
MD5 dc2d4cec94e456055a4968aac89503d9
SHA1 cd5d56773c6f53b15425dfb7d719b08dea89e28d
SHA512 d784fa09347bd0f3a59a2a4ae2cb97228894e609a044ec52f950963f32846ce2f7a4f79125452b8a12369012dcf433ed7dff3b29152ff8e2cb8d376f6dccf508
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ehdidvszsdptq\mmdg.swx	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
544	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
900	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 1796 wrote to memory of 900	1796	regsvr32.exe	27
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28
PID 900 wrote to memory of 544	900	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc2d4cec94e456055a4968aac89503d9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc2d4cec94e456055a4968aac89503d9.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ehdidvszsdptq\mmdg.swx"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:544

memory/900-55-0x0000000075281000-0x0000000075283000-memory.dmp

Download

memory/900-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1796-54-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Download