emotet | 91db477ebd4078f466066d60173620ec44535f06e3396f40ab89bb48326c0fc2

Analysis

Target
66c4a75ae28cf082734e800b88e0fb47.dll
Size 668KB
Sample220315-1ggaaaefdr
SHA256 91db477ebd4078f466066d60173620ec44535f06e3396f40ab89bb48326c0fc2
MD5 66c4a75ae28cf082734e800b88e0fb47
SHA1 1071b1b30d9def9b4a4311be10ceb6ad96871f4a
SHA512 676e364eeb3e47d8475f057a6793950ed94a476ab87a23db71e55f2951c016c32510a65246c2fc41a6124d74e444e31d284b5e9e6c898ac15b5c519cbca2318e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
1260	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dfujaepogbiagrvc\zpdyfcynb.wfk	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1260	regsvr32.exe
1260	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2708	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2708	1624	regsvr32.exe	82
PID 1624 wrote to memory of 2708	1624	regsvr32.exe	82
PID 1624 wrote to memory of 2708	1624	regsvr32.exe	82
PID 2708 wrote to memory of 1260	2708	regsvr32.exe	90
PID 2708 wrote to memory of 1260	2708	regsvr32.exe	90
PID 2708 wrote to memory of 1260	2708	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\66c4a75ae28cf082734e800b88e0fb47.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\66c4a75ae28cf082734e800b88e0fb47.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Dfujaepogbiagrvc\zpdyfcynb.wfk"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1260

memory/1260-138-0x00000000028D0000-0x00000000028F7000-memory.dmp

Download

memory/2708-134-0x0000000000AC0000-0x0000000000AE7000-memory.dmp

Download