emotet | e7397bc8fd2b07b688482fbb4d0cbcc7813d678c61bcb3b750e5559e9a65600a

Analysis

Target
868fa82524f263d5d38ac940c74eacd1.dll
Size 801KB
Sample220314-pphmjafcc7
SHA256 e7397bc8fd2b07b688482fbb4d0cbcc7813d678c61bcb3b750e5559e9a65600a
MD5 868fa82524f263d5d38ac940c74eacd1
SHA1 cf58ecc27e493e90f9c4dc4632cc9256252454d1
SHA512 5b5a6626349fd1687140b63ad5714086fd85d63d8989ada5221a653de4faaf6f08cb823ff1453f4c07f83f0c54531704ac67d37c5b6af49d89061f2f866b4760
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Laefdxhtu\xfnscsj.iui	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1972	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
852	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 2004 wrote to memory of 852	2004	regsvr32.exe	27
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28
PID 852 wrote to memory of 1972	852	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\868fa82524f263d5d38ac940c74eacd1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\868fa82524f263d5d38ac940c74eacd1.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Laefdxhtu\xfnscsj.iui"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1972

memory/852-55-0x00000000765D1000-0x00000000765D3000-memory.dmp

Download

memory/852-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/2004-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download