emotet | 315d6240bf34e4b0e737eaad2ae9d9605966b63adc8fc1ccddad9bb5b374431d

Analysis

Target
e92948e9dc37d4520b5f650c45aba552.dll
Size 664KB
Sample220316-lhmfcsbgh7
SHA256 315d6240bf34e4b0e737eaad2ae9d9605966b63adc8fc1ccddad9bb5b374431d
MD5 e92948e9dc37d4520b5f650c45aba552
SHA1 9f65b189197b7eb58f5f168bd28fdff11fb92651
SHA512 bd0d18da6e3e34d7e74ca4c63d52c7e6dcc168958d94aca2b75360ee4d26b38b0e7a683fa3228efdee4cbe2c5c67f98c3fca703d9302b4b3e871209d15da254c
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tjbyqnvbbkhqjc\oemzkkabmw.ntn	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1144	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1836 wrote to memory of 1664	1836	regsvr32.exe	27
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1144	1664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e92948e9dc37d4520b5f650c45aba552.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e92948e9dc37d4520b5f650c45aba552.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Tjbyqnvbbkhqjc\oemzkkabmw.ntn"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1144

memory/1144-61-0x00000000008A0000-0x00000000008D4000-memory.dmp

Download

memory/1664-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Download

memory/1664-56-0x0000000000250000-0x0000000000284000-memory.dmp

Download

memory/1836-54-0x000007FEFC1E1000-0x000007FEFC1E3000-memory.dmp

Download