emotet | dc3cdf0fd7772d44a0bab8f3476a9c84f309a3fa9f36b8243dd284735d67831a

Analysis

Target
d3f0a70dcf197138fd9462e7551ce453.dll
Size 573KB
Sample220314-mm9l5aecf2
SHA256 dc3cdf0fd7772d44a0bab8f3476a9c84f309a3fa9f36b8243dd284735d67831a
MD5 d3f0a70dcf197138fd9462e7551ce453
SHA1 4120503d9f5068a8d56ed6479b355f7d2acf5b81
SHA512 e491df34f37c64a6ecd0dea140ac7ce5feb0f4e94b54498a7231793e5325b4c92dbc06f2f1e754deebb6ffb2e1293320c8a54c2459058f6a90ee8ac20c6c71ae
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1132	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ueolujmq\arpttydebpcdj.soo	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	regsvr32.exe
1132	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
716	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 716	1288	regsvr32.exe	82
PID 1288 wrote to memory of 716	1288	regsvr32.exe	82
PID 1288 wrote to memory of 716	1288	regsvr32.exe	82
PID 716 wrote to memory of 1132	716	regsvr32.exe	85
PID 716 wrote to memory of 1132	716	regsvr32.exe	85
PID 716 wrote to memory of 1132	716	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d3f0a70dcf197138fd9462e7551ce453.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d3f0a70dcf197138fd9462e7551ce453.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ueolujmq\arpttydebpcdj.soo"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1132

memory/716-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download