emotet | 8bbacc9b2081c881e0f5ae0fbc604449fc2b25fed5b21c1843c94cf2058fd37a

Analysis

Target
59845edc09e359d3a4598568cbe21744.dll
Size 996KB
Sample220315-ve41nsdfd9
SHA256 8bbacc9b2081c881e0f5ae0fbc604449fc2b25fed5b21c1843c94cf2058fd37a
MD5 59845edc09e359d3a4598568cbe21744
SHA1 58c3136309872a68ca0f8f6c2097f411e22fb3e7
SHA512 67dcb1eae5572e33a6c302b89936301df8281cb2f79c115c7c745d23e432634581a335a2f04099823c5338fd9d5e59313881a767dfb5eb9cacbe478813046d98
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fztnmieu\lstbupnkvrs.nbg	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
908	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
968	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 1860 wrote to memory of 968	1860	regsvr32.exe	27
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28
PID 968 wrote to memory of 908	968	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59845edc09e359d3a4598568cbe21744.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59845edc09e359d3a4598568cbe21744.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Fztnmieu\lstbupnkvrs.nbg"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:908

memory/908-60-0x00000000001F0000-0x0000000000217000-memory.dmp

Download

memory/968-55-0x0000000075271000-0x0000000075273000-memory.dmp

Download

memory/968-56-0x0000000000410000-0x0000000000437000-memory.dmp

Download

memory/1860-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download