emotet | 6171949ea48d87a5b9384c5a89b3984e5d4f07995d61fb5c42628258f45b80bc

Analysis

Target
4ec9d306d2172a27f970a8838ad822a2.dll
Size 573KB
Sample220314-w92dpsbab6
SHA256 6171949ea48d87a5b9384c5a89b3984e5d4f07995d61fb5c42628258f45b80bc
MD5 4ec9d306d2172a27f970a8838ad822a2
SHA1 f52fc56b9d77131b2fff8235ee8b170ef6e1337c
SHA512 1e75a08754032969ea271c31c0f3e70a2f56331ff43d34d6482dd7efdaa1d7695db505c87660197daad2e87b73397de70da064674f2c8be30217ece3976575e1
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kmgtsxd\bmzsfcfm.dhn	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1792	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1900	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1876 wrote to memory of 1900	1876	regsvr32.exe	27
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28
PID 1900 wrote to memory of 1792	1900	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ec9d306d2172a27f970a8838ad822a2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4ec9d306d2172a27f970a8838ad822a2.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kmgtsxd\bmzsfcfm.dhn"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1792

memory/1876-54-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Download

memory/1900-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Download

memory/1900-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download