emotet | ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040

Analysis

Target
ff81cdc86b7c12c33ed8c106fb0c0b48.dll
Size 996KB
Sample220315-rn1stscfd2
SHA256 ad9f5e3ac5323892bb626eed057e2d41b652be8a1c89bea111e64aff8dae5040
MD5 ff81cdc86b7c12c33ed8c106fb0c0b48
SHA1 9ccfcb9a85cc9771b4696cfc1de4b954ab7fcecc
SHA512 c5127f792a8dceec8a572c9d0605aad829caaae05690c47c53f2a63f914743a69d711091f80bdba112bf005c34759426a5f4d4c501b59d430bee71dca021ecec
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2276	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ryuwlwppibgda\sxviuoyt.dgz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2276	regsvr32.exe
2276	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4880	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4880	532	regsvr32.exe	81
PID 532 wrote to memory of 4880	532	regsvr32.exe	81
PID 532 wrote to memory of 4880	532	regsvr32.exe	81
PID 4880 wrote to memory of 2276	4880	regsvr32.exe	87
PID 4880 wrote to memory of 2276	4880	regsvr32.exe	87
PID 4880 wrote to memory of 2276	4880	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff81cdc86b7c12c33ed8c106fb0c0b48.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ff81cdc86b7c12c33ed8c106fb0c0b48.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ryuwlwppibgda\sxviuoyt.dgz"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2276

memory/2276-138-0x00000000029E0000-0x0000000002A07000-memory.dmp

Download

memory/4880-135-0x0000000003060000-0x0000000003087000-memory.dmp

Download