emotet | f2aa930f79021e2dd5f9e8b80f6982e34ddccfc4cc338f53c3acca638c175b2f

Analysis

Target
emotet_exe_e4_f2aa930f79021e2dd5f9e8b80f6982e34ddccfc4cc338f53c3acca638c175b2f_2022-03-14__233805.dll
Size 997KB
Sample220314-3nar7adgf2
SHA256 f2aa930f79021e2dd5f9e8b80f6982e34ddccfc4cc338f53c3acca638c175b2f
MD5 398ca300fcd3efb3b785a49aef99027e
SHA1 5aa79d74a23137119be10a2c1198183f99b81017
SHA512 e8eaa65a6de42d893374a947c330fd15dd8ec6fccd658abdcc21601e1e017bd7c8d9e9a3b2da87ea2790958aaac438c3dadefeffdaf7c0eb92934e367f2150c4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1352	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Imllvb\ppfzdhabmdp.nul	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1352	regsvr32.exe
1352	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
616	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 616	4800	regsvr32.exe	82
PID 4800 wrote to memory of 616	4800	regsvr32.exe	82
PID 4800 wrote to memory of 616	4800	regsvr32.exe	82
PID 616 wrote to memory of 1352	616	regsvr32.exe	88
PID 616 wrote to memory of 1352	616	regsvr32.exe	88
PID 616 wrote to memory of 1352	616	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f2aa930f79021e2dd5f9e8b80f6982e34ddccfc4cc338f53c3acca638c175b2f_2022-03-14__233805.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f2aa930f79021e2dd5f9e8b80f6982e34ddccfc4cc338f53c3acca638c175b2f_2022-03-14__233805.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Imllvb\ppfzdhabmdp.nul"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1352

memory/616-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download