emotet | 8276fcc3bd911058be944bcefc9d86e6ab50ea45c065fa94e07b6f02a784c5e8

Analysis

Target
929d1ec216c8651244d7de8ca4d20a3d.dll
Size 573KB
Sample220314-w92dpsbab5
SHA256 8276fcc3bd911058be944bcefc9d86e6ab50ea45c065fa94e07b6f02a784c5e8
MD5 929d1ec216c8651244d7de8ca4d20a3d
SHA1 6f1364a162ce26238a9df66a022f5517b2059cc5
SHA512 f6bb49ef4f87372f304bec88117dfd2fed033e81678a7d3e0569c68d8cbd818467f4478f55f8f716cf8f3c3f389f4eca8da8f41c1b7b0c1888fed9b3239ab648
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
388	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pcodsq\jpwbsxg.mwh	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
388	regsvr32.exe
388	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3860	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 3860	2824	regsvr32.exe	82
PID 2824 wrote to memory of 3860	2824	regsvr32.exe	82
PID 2824 wrote to memory of 3860	2824	regsvr32.exe	82
PID 3860 wrote to memory of 388	3860	regsvr32.exe	90
PID 3860 wrote to memory of 388	3860	regsvr32.exe	90
PID 3860 wrote to memory of 388	3860	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\929d1ec216c8651244d7de8ca4d20a3d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\929d1ec216c8651244d7de8ca4d20a3d.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Pcodsq\jpwbsxg.mwh"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:388

memory/3860-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download