emotet | ee65366e3645f9bef5f9bea967a38305a772c0c228e142da8da2d2f0162e2d31

Analysis

Target
9a3f6999f3a49ca1b2544f966ba23001.dll
Size 668KB
Sample220316-ct5xeafdfl
SHA256 ee65366e3645f9bef5f9bea967a38305a772c0c228e142da8da2d2f0162e2d31
MD5 9a3f6999f3a49ca1b2544f966ba23001
SHA1 fa4d32593f9275a39f77ce8b837571b48d0026d4
SHA512 af4fbbd5c90d5d631895531663d1d2efbdac77f4d8392458bef2400d41f600b3117324c0175569f7f0198bdbae5d0afefe0228dd22d56cbead836eb390672ef8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
1224	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hmygpuncshuhywjf\vuvhoshkexuek.jja	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	regsvr32.exe
1224	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4472	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4472	2156	regsvr32.exe	82
PID 2156 wrote to memory of 4472	2156	regsvr32.exe	82
PID 2156 wrote to memory of 4472	2156	regsvr32.exe	82
PID 4472 wrote to memory of 1224	4472	regsvr32.exe	85
PID 4472 wrote to memory of 1224	4472	regsvr32.exe	85
PID 4472 wrote to memory of 1224	4472	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9a3f6999f3a49ca1b2544f966ba23001.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9a3f6999f3a49ca1b2544f966ba23001.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Hmygpuncshuhywjf\vuvhoshkexuek.jja"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1224

memory/1224-138-0x0000000000D70000-0x0000000000D97000-memory.dmp

Download

memory/4472-134-0x00000000030A0000-0x00000000030C7000-memory.dmp

Download