emotet | 5f58bd89e7206e8964e2f14f701dccb471ac7a87108246ff1de99fcb726135ea

Analysis

Target
20ede056f9a1313ad85684f51eb1a05b.dll
Size 668KB
Sample220315-yzd7jafeb5
SHA256 5f58bd89e7206e8964e2f14f701dccb471ac7a87108246ff1de99fcb726135ea
MD5 20ede056f9a1313ad85684f51eb1a05b
SHA1 87d8c6811c82e835cbf93b011ba93466e0dd6b4a
SHA512 5ee614e1f12841c26633e3269eeab58408061c76f2e335200e09d91c4b05808f0c4a9f6efda455ea9998d55bec6593eeadc681798bcf2c1e28ac5444a7eeb0fe
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 2 IoCs

pid	Process
3200	regsvr32.exe
3736	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ysefrgapmqx\bxclykcrkbo.sxn	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\Vzzwfylyraeocw\xfdfv.hgq	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3736	regsvr32.exe
3736	regsvr32.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
4280	regsvr32.exe
3200	regsvr32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4280	4256	regsvr32.exe	81
PID 4256 wrote to memory of 4280	4256	regsvr32.exe	81
PID 4256 wrote to memory of 4280	4256	regsvr32.exe	81
PID 4280 wrote to memory of 3200	4280	regsvr32.exe	88
PID 4280 wrote to memory of 3200	4280	regsvr32.exe	88
PID 4280 wrote to memory of 3200	4280	regsvr32.exe	88
PID 3200 wrote to memory of 3736	3200	regsvr32.exe	89
PID 3200 wrote to memory of 3736	3200	regsvr32.exe	89
PID 3200 wrote to memory of 3736	3200	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\20ede056f9a1313ad85684f51eb1a05b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\20ede056f9a1313ad85684f51eb1a05b.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ysefrgapmqx\bxclykcrkbo.sxn"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vzzwfylyraeocw\xfdfv.hgq"
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3736

memory/3200-138-0x00000000028F0000-0x0000000002917000-memory.dmp

Download

memory/3736-142-0x0000000002DF0000-0x0000000002E17000-memory.dmp

Download

memory/4280-134-0x0000000002380000-0x00000000023A7000-memory.dmp

Download