emotet | 3e85dca05ce3fbc714702b95945f13d176b93e946d152168df4dfc8cfe04dca9

Analysis

Target
54272c09c6e88325ef39e8a751208bfd.dll
Size 640KB
Sample220311-vlv2caade2
SHA256 3e85dca05ce3fbc714702b95945f13d176b93e946d152168df4dfc8cfe04dca9
MD5 54272c09c6e88325ef39e8a751208bfd
SHA1 4aa1010c4f9d4054d51a42a60b82b146dc02d107
SHA512 66f89473c5fbc1f9608a2ec8731a14e69060ec565e340ab9621f7829ae5cf3132f9627db4c1b1f519d2c2ee638d3ab95d2bef731adc1014d69e12f6d004b984c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Rvjbo\omqjbp.hwv	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1888	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
956	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 1760 wrote to memory of 956	1760	regsvr32.exe	27
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28
PID 956 wrote to memory of 1888	956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\54272c09c6e88325ef39e8a751208bfd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\54272c09c6e88325ef39e8a751208bfd.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Rvjbo\omqjbp.hwv"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1888

memory/956-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Download

memory/956-56-0x0000000000240000-0x0000000000267000-memory.dmp

Download

memory/1760-54-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/1888-60-0x0000000000340000-0x0000000000367000-memory.dmp

Download