emotet | 58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f

Analysis

Target
emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
Size 996KB
Sample220315-aexw5sebb2
SHA256 58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f
MD5 fcb73e00f228c4784827cb4151f62fa1
SHA1 a7380f2d7cf2732ba3bda90b9b6e29468a4ae304
SHA512 77cccadfe71d85bc9a3346d8c1c6721ea479f5384f8247c14de2abf96a797ab95397cdfe8a20aebed44be5b60b54e1c0000f4a3afd1c93a781ef1cb9f840199d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pkzrcsg\oawtxaa.hfz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1464	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
696	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 1616 wrote to memory of 696	1616	regsvr32.exe	27
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28
PID 696 wrote to memory of 1464	696	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Pkzrcsg\oawtxaa.hfz"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1464

memory/696-55-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/696-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1616-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download