emotet | f136af801932905f8d4bf029cb3d6017cfc6434d4c84ef09de054a0794c291a2

Analysis

Target
emotet_exe_e5_f136af801932905f8d4bf029cb3d6017cfc6434d4c84ef09de054a0794c291a2_2022-03-15__000708.dll
Size 996KB
Sample220315-aexldaeba6
SHA256 f136af801932905f8d4bf029cb3d6017cfc6434d4c84ef09de054a0794c291a2
MD5 9bef6fea689ce059a906dce75f32e8fc
SHA1 94cf77955e0a55f7039144641eea77ebd03b7edd
SHA512 a00070e4e38783a1ab4cd73ea288038c9fecd194181e727a805ee4542740424131bbd7ede0aea7ae817b773f414ed4fc8c1052655fdd7ce7389beed929867161
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hyinck\vtnohvfnye.wyr	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1124	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1628	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1628	1636	regsvr32.exe	27
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28
PID 1628 wrote to memory of 1124	1628	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f136af801932905f8d4bf029cb3d6017cfc6434d4c84ef09de054a0794c291a2_2022-03-15__000708.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f136af801932905f8d4bf029cb3d6017cfc6434d4c84ef09de054a0794c291a2_2022-03-15__000708.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Hyinck\vtnohvfnye.wyr"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1124

memory/1628-55-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1628-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1636-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download