emotet | 703d7b363a930e0ccba061d98f8fd4f0ee647e056d03ecd1c59e3e0b9ac885c7

Analysis

Target
60292b49cda1acf213fd1cdc35f6f745.dll
Size 996KB
Sample220315-ve41nsdfe3
SHA256 703d7b363a930e0ccba061d98f8fd4f0ee647e056d03ecd1c59e3e0b9ac885c7
MD5 60292b49cda1acf213fd1cdc35f6f745
SHA1 505a52a8146d99e7aa322e577b1926ad2d7d8a94
SHA512 f3afbde7f9781255b4e042905b48b46cfe9732cd1958fcd32c2dcfa0935d6e7f103515ac1800e657d9051d1ff2f16d6e813a4fa59b92bc91ad567aed2af4a82e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Rqgemreu\ypzdc.xro	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
828	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
640	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 616 wrote to memory of 640	616	regsvr32.exe	27
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29
PID 640 wrote to memory of 828	640	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60292b49cda1acf213fd1cdc35f6f745.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\60292b49cda1acf213fd1cdc35f6f745.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Rqgemreu\ypzdc.xro"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:828

memory/616-54-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Download

memory/640-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Download

memory/640-56-0x00000000001E0000-0x0000000000207000-memory.dmp

Download

memory/828-60-0x0000000000330000-0x0000000000357000-memory.dmp

Download