emotet | cacbb636ea6845551ba76f297abe972297205ca1ddc480ba00ab8c35ca31fb46

Analysis

Target
24d0a28f83a90326d211a6cdcebde32c.dll
Size 664KB
Sample220316-kap1vabba3
SHA256 cacbb636ea6845551ba76f297abe972297205ca1ddc480ba00ab8c35ca31fb46
MD5 24d0a28f83a90326d211a6cdcebde32c
SHA1 3b4554b3383350a736979d4ef9e274bafe9ad5f1
SHA512 8b3ae2c298f92a7ce29e4898e985281e36af4c95a86eed2b9463b77a8f7d127bb57aa6aed6144144127405f1b009e74a6ff032bb3f1597e91844c40437bba196
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bpotqvhww\poshvldrykiy.why	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1468	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1812	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1968 wrote to memory of 1812	1968	regsvr32.exe	27
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28
PID 1812 wrote to memory of 1468	1812	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\24d0a28f83a90326d211a6cdcebde32c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\24d0a28f83a90326d211a6cdcebde32c.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Bpotqvhww\poshvldrykiy.why"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1468

memory/1812-55-0x0000000074F21000-0x0000000074F23000-memory.dmp

Download

memory/1812-56-0x00000000009E0000-0x0000000000A14000-memory.dmp

Download

memory/1968-54-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Download