emotet | a4940991df63e759c4df1bb50a9cbae22218329406a0aef42b58203763b64b46

Analysis

Target
db16aa67890a7caf9a54a25184f9c192.dll
Size 573KB
Sample220314-w92dpsdaem
SHA256 a4940991df63e759c4df1bb50a9cbae22218329406a0aef42b58203763b64b46
MD5 db16aa67890a7caf9a54a25184f9c192
SHA1 123a970f547d2206edc8533f9dbd53c7a78b56e6
SHA512 5a67aa05c1be5037cf4cfc0082e7aa1853335920d621544c0633cacb4fbdb558aba43514c6364d3a66770354685bc184cfc45fa86aebfaf028540ee71f5f2e40
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
1668	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ewsvxbiipxcqeng\zswbkzrvfqvee.xlw	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	regsvr32.exe
1668	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1932	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1932	4800	regsvr32.exe	82
PID 4800 wrote to memory of 1932	4800	regsvr32.exe	82
PID 4800 wrote to memory of 1932	4800	regsvr32.exe	82
PID 1932 wrote to memory of 1668	1932	regsvr32.exe	90
PID 1932 wrote to memory of 1668	1932	regsvr32.exe	90
PID 1932 wrote to memory of 1668	1932	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\db16aa67890a7caf9a54a25184f9c192.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\db16aa67890a7caf9a54a25184f9c192.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ewsvxbiipxcqeng\zswbkzrvfqvee.xlw"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1668

memory/1932-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download