emotet | ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6

Analysis

Target
emotet_exe_e4_ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6_2022-03-15__000446.dll
Size 997KB
Sample220315-adbbraeae6
SHA256 ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6
MD5 fd89f15c5f77d4669f9ae02e3a712140
SHA1 caae83a99c4485416e20ec9ebd768501e28293d8
SHA512 002ae7f9fe47dd9eb54974d197b6c66d43f5e937bf88db15e9201a3bc1a33672ca5cc50b59c9591ef7ca198d742deb79de6b2c3b455c5b6b4622d98cf65540fc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3568	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wzpbudzdvelob\ogtmh.bta	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3568	regsvr32.exe
3568	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2116	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2116	4020	regsvr32.exe	83
PID 4020 wrote to memory of 2116	4020	regsvr32.exe	83
PID 4020 wrote to memory of 2116	4020	regsvr32.exe	83
PID 2116 wrote to memory of 3568	2116	regsvr32.exe	89
PID 2116 wrote to memory of 3568	2116	regsvr32.exe	89
PID 2116 wrote to memory of 3568	2116	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6_2022-03-15__000446.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ceb38948c3eaae9e6ba83db2778e32b2b01a66640a33fca762df81209e6a5fd6_2022-03-15__000446.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Wzpbudzdvelob\ogtmh.bta"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3568

memory/2116-134-0x0000000010000000-0x0000000010028000-memory.dmp

Download