emotet | 58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f

Analysis

Target
emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
Size 996KB
Sample220315-aexw5sebb2
SHA256 58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f
MD5 fcb73e00f228c4784827cb4151f62fa1
SHA1 a7380f2d7cf2732ba3bda90b9b6e29468a4ae304
SHA512 77cccadfe71d85bc9a3346d8c1c6721ea479f5384f8247c14de2abf96a797ab95397cdfe8a20aebed44be5b60b54e1c0000f4a3afd1c93a781ef1cb9f840199d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
684	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mfxgryvxnmfe\ahruczy.yzr	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
684	regsvr32.exe
684	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1256	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 1256	4944	regsvr32.exe	82
PID 4944 wrote to memory of 1256	4944	regsvr32.exe	82
PID 4944 wrote to memory of 1256	4944	regsvr32.exe	82
PID 1256 wrote to memory of 684	1256	regsvr32.exe	83
PID 1256 wrote to memory of 684	1256	regsvr32.exe	83
PID 1256 wrote to memory of 684	1256	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_58cfdf334e3926ae777f454d24f5d244939dca061ea9947fab1b4cb56d285c4f_2022-03-15__000711.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Mfxgryvxnmfe\ahruczy.yzr"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:684

memory/1256-134-0x0000000010000000-0x0000000010027000-memory.dmp

Download