emotet | 703d7b363a930e0ccba061d98f8fd4f0ee647e056d03ecd1c59e3e0b9ac885c7

Analysis

Target
60292b49cda1acf213fd1cdc35f6f745.dll
Size 996KB
Sample220315-ve41nsdfe3
SHA256 703d7b363a930e0ccba061d98f8fd4f0ee647e056d03ecd1c59e3e0b9ac885c7
MD5 60292b49cda1acf213fd1cdc35f6f745
SHA1 505a52a8146d99e7aa322e577b1926ad2d7d8a94
SHA512 f3afbde7f9781255b4e042905b48b46cfe9732cd1958fcd32c2dcfa0935d6e7f103515ac1800e657d9051d1ff2f16d6e813a4fa59b92bc91ad567aed2af4a82e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 2 IoCs

pid	Process
3020	regsvr32.exe
3628	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qnxibfmbyfgdyfo\oimwsthjjuv.rgg	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\Netguknhdsgryt\jylstbvw.oop	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	regsvr32.exe
3628	regsvr32.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4316	regsvr32.exe
3020	regsvr32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 4316	3664	regsvr32.exe	81
PID 3664 wrote to memory of 4316	3664	regsvr32.exe	81
PID 3664 wrote to memory of 4316	3664	regsvr32.exe	81
PID 4316 wrote to memory of 3020	4316	regsvr32.exe	88
PID 4316 wrote to memory of 3020	4316	regsvr32.exe	88
PID 4316 wrote to memory of 3020	4316	regsvr32.exe	88
PID 3020 wrote to memory of 3628	3020	regsvr32.exe	89
PID 3020 wrote to memory of 3628	3020	regsvr32.exe	89
PID 3020 wrote to memory of 3628	3020	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60292b49cda1acf213fd1cdc35f6f745.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\60292b49cda1acf213fd1cdc35f6f745.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Qnxibfmbyfgdyfo\oimwsthjjuv.rgg"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Netguknhdsgryt\jylstbvw.oop"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3628

memory/3020-138-0x0000000002DF0000-0x0000000002E17000-memory.dmp

Download

memory/3628-142-0x0000000002610000-0x0000000002637000-memory.dmp

Download

memory/4316-134-0x0000000002CF0000-0x0000000002D17000-memory.dmp

Download