emotet | 57d31c199197dba165fe8d09d6d31e12d9e12e998d7fef17a09ea0b8e667f326

Analysis

Target
73294e586a82b9941bd64f42c55fc689.dll
Size 573KB
Sample220314-x8zddsbed2
SHA256 57d31c199197dba165fe8d09d6d31e12d9e12e998d7fef17a09ea0b8e667f326
MD5 73294e586a82b9941bd64f42c55fc689
SHA1 730836ba0d4cb0c2b5917a488b92ee46ae8c03ec
SHA512 ba4c511a71901aff92a21731514422c505d2897ef2e7ad67a59085c2f7c221efdcda9549187906e3b704b7e7196c41f046766c7082852893ce127edba777dbf6
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lxkjqea\nlzkxpdbfeks.tzj	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1968	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1124	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1472 wrote to memory of 1124	1472	regsvr32.exe	27
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28
PID 1124 wrote to memory of 1968	1124	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73294e586a82b9941bd64f42c55fc689.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73294e586a82b9941bd64f42c55fc689.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Lxkjqea\nlzkxpdbfeks.tzj"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1968

memory/1124-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Download

memory/1124-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1472-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Download