emotet | f16e8c255ee2fbd9b189b73c442333e8a6b09c5e66a654b2faea694fb87db9f0

Analysis

Target
b5b6a7c1611244440de5d2586dda69f8.dll
Size 1004KB
Sample220315-peb21abcb7
SHA256 f16e8c255ee2fbd9b189b73c442333e8a6b09c5e66a654b2faea694fb87db9f0
MD5 b5b6a7c1611244440de5d2586dda69f8
SHA1 a9bedfb51c927a50ffe63f0172acd6c8b960d8cb
SHA512 27ca917555091db7fa95c9f754d91d7df05cca7c771d624445fc41730fea295177aad48e100c0beed75478cbb8ff51fbffcf1dc2107d90f733b299dd26345a24
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1624	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Izhnsiqyh\dtgmsgmlhyzfhtx.cga	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	regsvr32.exe
1624	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3320	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3320	5084	regsvr32.exe	82
PID 5084 wrote to memory of 3320	5084	regsvr32.exe	82
PID 5084 wrote to memory of 3320	5084	regsvr32.exe	82
PID 3320 wrote to memory of 1624	3320	regsvr32.exe	92
PID 3320 wrote to memory of 1624	3320	regsvr32.exe	92
PID 3320 wrote to memory of 1624	3320	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5b6a7c1611244440de5d2586dda69f8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b5b6a7c1611244440de5d2586dda69f8.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Izhnsiqyh\dtgmsgmlhyzfhtx.cga"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1624

memory/1624-138-0x0000000002370000-0x0000000002398000-memory.dmp

Download

memory/3320-135-0x0000000002530000-0x0000000002558000-memory.dmp

Download