emotet | 441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff

Analysis

Target
emotet_exe_e5_441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff_2022-03-16__000332.dll
Size 668KB
Sample220316-acl2vsgeh7
SHA256 441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff
MD5 e03d0bd63144e8cb2da90b164dd311fb
SHA1 e53eaa1f9bbef1f266da17d2a96964c4589a3f83
SHA512 12a8877883c71d04a5563761b0326062a88031d51d5016febff7d66a3cb3b06c184f4304c51627bee89ecd0c6d2598b7659f81b4a1dd267066373f9e76fc37e3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3632	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Vnehjvlljffyju\rxzkpfv.wjt	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3632	regsvr32.exe
3632	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5056	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 5056	4144	regsvr32.exe	82
PID 4144 wrote to memory of 5056	4144	regsvr32.exe	82
PID 4144 wrote to memory of 5056	4144	regsvr32.exe	82
PID 5056 wrote to memory of 3632	5056	regsvr32.exe	90
PID 5056 wrote to memory of 3632	5056	regsvr32.exe	90
PID 5056 wrote to memory of 3632	5056	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff_2022-03-16__000332.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff_2022-03-16__000332.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vnehjvlljffyju\rxzkpfv.wjt"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3632

memory/3632-138-0x0000000002E20000-0x0000000002E47000-memory.dmp

Download

memory/5056-134-0x0000000002C60000-0x0000000002C87000-memory.dmp

Download