emotet | 8b743c4bf1e4e503ce3e4dbeb93c6a8105d7415ebc3f57de032959e619a23434

Analysis

Target
fe7e2b110535be3f713827c29ffd1e5f.dll
Size 573KB
Sample220314-w92dpsbab7
SHA256 8b743c4bf1e4e503ce3e4dbeb93c6a8105d7415ebc3f57de032959e619a23434
MD5 fe7e2b110535be3f713827c29ffd1e5f
SHA1 ac7377bef74a80432bc3891b93ea97bd3a388992
SHA512 ee66368c920942bcd1ce3fedd7dd0db54b00a242bffda1b8d2ad9961dd856d4cb518da15a4a4868cd9dc80acc0b46e82a9b9b2f71a3fe46ac8b3189267e0045a
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3536	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fzocegdwvi\dqkkudbzvg.mee	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3536	regsvr32.exe
3536	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1648	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1648	5088	regsvr32.exe	84
PID 5088 wrote to memory of 1648	5088	regsvr32.exe	84
PID 5088 wrote to memory of 1648	5088	regsvr32.exe	84
PID 1648 wrote to memory of 3536	1648	regsvr32.exe	90
PID 1648 wrote to memory of 3536	1648	regsvr32.exe	90
PID 1648 wrote to memory of 3536	1648	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe7e2b110535be3f713827c29ffd1e5f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe7e2b110535be3f713827c29ffd1e5f.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Fzocegdwvi\dqkkudbzvg.mee"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3536

memory/1648-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download