emotet | 8b743c4bf1e4e503ce3e4dbeb93c6a8105d7415ebc3f57de032959e619a23434

Analysis

Target
fe7e2b110535be3f713827c29ffd1e5f.dll
Size 573KB
Sample220314-w92dpsbab7
SHA256 8b743c4bf1e4e503ce3e4dbeb93c6a8105d7415ebc3f57de032959e619a23434
MD5 fe7e2b110535be3f713827c29ffd1e5f
SHA1 ac7377bef74a80432bc3891b93ea97bd3a388992
SHA512 ee66368c920942bcd1ce3fedd7dd0db54b00a242bffda1b8d2ad9961dd856d4cb518da15a4a4868cd9dc80acc0b46e82a9b9b2f71a3fe46ac8b3189267e0045a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ndujoh\lwyvjmxy.ttk	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1404	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1648 wrote to memory of 1092	1648	regsvr32.exe	27
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28
PID 1092 wrote to memory of 1404	1092	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe7e2b110535be3f713827c29ffd1e5f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe7e2b110535be3f713827c29ffd1e5f.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ndujoh\lwyvjmxy.ttk"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1404

memory/1092-55-0x0000000074CC1000-0x0000000074CC3000-memory.dmp

Download

memory/1092-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1648-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Download