emotet | e428eaf62376cfe30fc20e25c62cd38fd3bdb86072a50c165725337425fb1615

Analysis

Target
d4aa5ddf9b2d6c322f9a872fc6267346.dll
Size 996KB
Sample220315-ve41nsdfe2
SHA256 e428eaf62376cfe30fc20e25c62cd38fd3bdb86072a50c165725337425fb1615
MD5 d4aa5ddf9b2d6c322f9a872fc6267346
SHA1 b3433263cb105a4361c14eae680c9d4d0a213885
SHA512 a79ab92a8c1957107bf51f1e570b50ae7c1eb07fa4279afd2d94dfa8b685ce03002d855ba80d0e960e7f7f23c8698d1d9b3fa480795bb106d4b14075658595dc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jfiwascdwntth\hhzzvuc.zwa	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1888	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1828	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1844 wrote to memory of 1828	1844	regsvr32.exe	27
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30
PID 1828 wrote to memory of 1888	1828	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d4aa5ddf9b2d6c322f9a872fc6267346.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d4aa5ddf9b2d6c322f9a872fc6267346.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Jfiwascdwntth\hhzzvuc.zwa"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1888

memory/1828-55-0x0000000075E61000-0x0000000075E63000-memory.dmp

Download

memory/1828-56-0x00000000004C0000-0x00000000004E7000-memory.dmp

Download

memory/1844-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download

memory/1888-60-0x0000000000300000-0x0000000000327000-memory.dmp

Download