emotet | 819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd

Analysis

Target
emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
Size 996KB
Sample220315-aexw5sebb3
SHA256 819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd
MD5 2610edf4cebb2154fd5a86a07f056cf4
SHA1 0cc9a2a4810fe1964ddee1c5f9cde0c8352f0d96
SHA512 82702eb9f4d17466e085f7dea164d9a5dfef6d794865a4cb132c070d37bb9cede05e85f1893b7f08ccb4db46e305178dd2df63d7f1d3df5407ba302e5b2ffa83
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kfwmt\bceowm.gua	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1752	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1920 wrote to memory of 1732	1920	regsvr32.exe	27
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28
PID 1732 wrote to memory of 1752	1732	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kfwmt\bceowm.gua"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1752

memory/1732-55-0x0000000075441000-0x0000000075443000-memory.dmp

Download

memory/1732-56-0x0000000010000000-0x0000000010027000-memory.dmp

Download

memory/1920-54-0x000007FEFB6E1000-0x000007FEFB6E3000-memory.dmp

Download