emotet | e81b25538516ec690c7bb5684e4465d9ee35d95f603e6ada4dafa7b88eac5bdf

Analysis

Target
c4c1c32c40dad08db3714b11549f39d1.dll
Size 573KB
Sample220314-x8zddsbed3
SHA256 e81b25538516ec690c7bb5684e4465d9ee35d95f603e6ada4dafa7b88eac5bdf
MD5 c4c1c32c40dad08db3714b11549f39d1
SHA1 0d46d7b646153e3dc8aca738cbe0d6b2a5b10c73
SHA512 390c2e89e7b05d21fcffcbb127d891ac62cbd6ee1dbf80dfc5f318e819cbcdb4e6dd7773d32e789b060a39a46217a9b75a7bcbdbb3a5f0757bc2919879cd86e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dpmleficbpser\therjaxy.jyl	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1664	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
752	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 1032 wrote to memory of 752	1032	regsvr32.exe	27
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28
PID 752 wrote to memory of 1664	752	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4c1c32c40dad08db3714b11549f39d1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c4c1c32c40dad08db3714b11549f39d1.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Dpmleficbpser\therjaxy.jyl"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1664

memory/752-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Download

memory/752-56-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/1032-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download