emotet | 819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd

Analysis

Target
emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
Size 996KB
Sample220315-aexw5sebb3
SHA256 819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd
MD5 2610edf4cebb2154fd5a86a07f056cf4
SHA1 0cc9a2a4810fe1964ddee1c5f9cde0c8352f0d96
SHA512 82702eb9f4d17466e085f7dea164d9a5dfef6d794865a4cb132c070d37bb9cede05e85f1893b7f08ccb4db46e305178dd2df63d7f1d3df5407ba302e5b2ffa83
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3704	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ncpnrhuzhbgznin\vfakhxrz.lmb	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	regsvr32.exe
3704	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4036	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4036	1988	regsvr32.exe	82
PID 1988 wrote to memory of 4036	1988	regsvr32.exe	82
PID 1988 wrote to memory of 4036	1988	regsvr32.exe	82
PID 4036 wrote to memory of 3704	4036	regsvr32.exe	89
PID 4036 wrote to memory of 3704	4036	regsvr32.exe	89
PID 4036 wrote to memory of 3704	4036	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_819df97e9d0c3b5b8a094bf51f5888dfde7d55964e95435fa47d9f2aac5705fd_2022-03-15__000713.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ncpnrhuzhbgznin\vfakhxrz.lmb"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3704

memory/4036-134-0x0000000010000000-0x0000000010027000-memory.dmp

Download