emotet | ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040

Analysis

Target
ff81cdc86b7c12c33ed8c106fb0c0b48.dll
Size 996KB
Sample220315-rn1stscfd2
SHA256 ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040
MD5 ff81cdc86b7c12c33ed8c106fb0c0b48
SHA1 9ccfcb9a85cc9771b4696cfc1de4b954ab7fcecc
SHA512 c5127f792a8dceec8a572c9d0605aad829caaae05690c47c53f2a63f914743a69d711091f80bdba112bf005c34759426a5f4d4c501b59d430bee71dca021ecec
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zkzjluzh\pqgppwf.mwu	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1104 wrote to memory of 1788	1104	regsvr32.exe	27
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28
PID 1788 wrote to memory of 1964	1788	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff81cdc86b7c12c33ed8c106fb0c0b48.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ff81cdc86b7c12c33ed8c106fb0c0b48.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Zkzjluzh\pqgppwf.mwu"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1964

memory/1104-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Download

memory/1788-55-0x0000000074F31000-0x0000000074F33000-memory.dmp

Download

memory/1788-56-0x0000000000240000-0x0000000000267000-memory.dmp

Download

memory/1964-60-0x00000000004C0000-0x00000000004E7000-memory.dmp

Download