emotet | ba4fa94dc652fb8d618a8a0fc298c93b9e8cce3331fbe2c39026b7203ffef8b5

Analysis

Target
R3lPMRyLzG5285aqFKrAK3bURoWr9.dll
Size 1004KB
Sample220315-ryk55acgg4
SHA256 ba4fa94dc652fb8d618a8a0fc298c93b9e8cce3331fbe2c39026b7203ffef8b5
MD5 9688c06ab514054724bdf1257197cc92
SHA1 5b207ccc144ad6a46ca0fb9ea447b8f9d2783652
SHA512 ec922448eae6ee73901f0e96c19b2f61cec34ae72085435524465d3ebdf02f63343c28020f3752ef0610df05a4ce7c389d756b0c7c111c267208db00ce8a483c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3108	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Oyatxljpzusrnsz\ziizrjji.xeg	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	regsvr32.exe
3108	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3084	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3084	2828	regsvr32.exe	82
PID 2828 wrote to memory of 3084	2828	regsvr32.exe	82
PID 2828 wrote to memory of 3084	2828	regsvr32.exe	82
PID 3084 wrote to memory of 3108	3084	regsvr32.exe	90
PID 3084 wrote to memory of 3108	3084	regsvr32.exe	90
PID 3084 wrote to memory of 3108	3084	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\R3lPMRyLzG5285aqFKrAK3bURoWr9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\R3lPMRyLzG5285aqFKrAK3bURoWr9.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Oyatxljpzusrnsz\ziizrjji.xeg"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3108

memory/3084-134-0x0000000002AF0000-0x0000000002B18000-memory.dmp

Download

memory/3108-138-0x0000000002A30000-0x0000000002A58000-memory.dmp

Download