emotet | 9e7713add5b075d8e2c89c35190d162b2ab0ff336d40256cc3dbcaceb47bb67a

Analysis

Target
emotet_exe_e4_9e7713add5b075d8e2c89c35190d162b2ab0ff336d40256cc3dbcaceb47bb67a_2022-03-14__233806.dll
Size 997KB
Sample220314-3nar7adge9
SHA256 9e7713add5b075d8e2c89c35190d162b2ab0ff336d40256cc3dbcaceb47bb67a
MD5 eec8fad87e795b7186d97ffc67faf3be
SHA1 8359b2ec43512d9e5943e01d8838e82af07061fc
SHA512 e65e9bcaf1b5d641220119dbe5b450fd9e1021b9012b036f942fc4f71169ce217d01e75df82ec7e4d50f99fcde0b204bc02347cab625ca31bb708e2e53fd3c9a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1088	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qyohn\gfvfroxbszdkoz.waz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	regsvr32.exe
1088	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
540	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 540	2692	regsvr32.exe	82
PID 2692 wrote to memory of 540	2692	regsvr32.exe	82
PID 2692 wrote to memory of 540	2692	regsvr32.exe	82
PID 540 wrote to memory of 1088	540	regsvr32.exe	90
PID 540 wrote to memory of 1088	540	regsvr32.exe	90
PID 540 wrote to memory of 1088	540	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e7713add5b075d8e2c89c35190d162b2ab0ff336d40256cc3dbcaceb47bb67a_2022-03-14__233806.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e7713add5b075d8e2c89c35190d162b2ab0ff336d40256cc3dbcaceb47bb67a_2022-03-14__233806.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Qyohn\gfvfroxbszdkoz.waz"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1088

memory/540-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download