emotet | 8276fcc3bd911058be944bcefc9d86e6ab50ea45c065fa94e07b6f02a784c5e8

Analysis

Target
929d1ec216c8651244d7de8ca4d20a3d.dll
Size 573KB
Sample220314-w92dpsbab5
SHA256 8276fcc3bd911058be944bcefc9d86e6ab50ea45c065fa94e07b6f02a784c5e8
MD5 929d1ec216c8651244d7de8ca4d20a3d
SHA1 6f1364a162ce26238a9df66a022f5517b2059cc5
SHA512 f6bb49ef4f87372f304bec88117dfd2fed033e81678a7d3e0569c68d8cbd818467f4478f55f8f716cf8f3c3f389f4eca8da8f41c1b7b0c1888fed9b3239ab648
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qtflzjfctiiwjq\fldzdtrpgiioz.nuw	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1212	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1952	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 2012 wrote to memory of 1952	2012	regsvr32.exe	27
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28
PID 1952 wrote to memory of 1212	1952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\929d1ec216c8651244d7de8ca4d20a3d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\929d1ec216c8651244d7de8ca4d20a3d.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Qtflzjfctiiwjq\fldzdtrpgiioz.nuw"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1212

memory/1952-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/1952-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/2012-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download