emotet | 662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152

Analysis

Target
emotet_exe_e5_662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152_2022-03-15__000708.dll
Size 996KB
Sample220315-aexldaeba5
SHA256 662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152
MD5 7adf81187c3586d35b2a375f521162f0
SHA1 6575b444eccb45d9e77c2e0854bdf6b5d0f6bc0a
SHA512 dbb0cf06d8cf1b8a41b83785ec89422697e62079533e033a10b2d08204b71de74da43b7443680647cb1554e126581d37e333e13ca6ebc8a1e137566ce09c0bbf
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cyyvnidvvozt\tuusswcgyfb.gkh	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1880	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1924 wrote to memory of 1880	1924	regsvr32.exe	27
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28
PID 1880 wrote to memory of 2044	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152_2022-03-15__000708.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_662c3c6cbccf84fb562666211d0062f3a6957f13bb7b3a57cae48d80f4add152_2022-03-15__000708.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Cyyvnidvvozt\tuusswcgyfb.gkh"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2044

memory/1880-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Download

memory/1880-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1924-54-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download