emotet | 6cd07b67d26fbc609e1fb41cd76937cc5e8c6e718d2735a562a164be3a20cb14

Analysis

Target
217a99434e68c6839832bb3381fecedd.dll
Size 664KB
Sample220316-sa1rcadbdl
SHA256 6cd07b67d26fbc609e1fb41cd76937cc5e8c6e718d2735a562a164be3a20cb14
MD5 217a99434e68c6839832bb3381fecedd
SHA1 1240509bcba993a24de8ac21e2ee768805953bda
SHA512 578254a695225fe48c715f17e9cfbf2e2031a4e9a36649a54bd5a880275d755ea007ca0f0a8df18a25bab1a10f21d06658909d7fb6ed336b59238a3c1da7f200
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3724	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Stwuw\clcvqanisjcvw.kxj	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	regsvr32.exe
3724	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1904	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1904	4316	regsvr32.exe	80
PID 4316 wrote to memory of 1904	4316	regsvr32.exe	80
PID 4316 wrote to memory of 1904	4316	regsvr32.exe	80
PID 1904 wrote to memory of 3724	1904	regsvr32.exe	86
PID 1904 wrote to memory of 3724	1904	regsvr32.exe	86
PID 1904 wrote to memory of 3724	1904	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\217a99434e68c6839832bb3381fecedd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\217a99434e68c6839832bb3381fecedd.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Stwuw\clcvqanisjcvw.kxj"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3724

memory/1904-134-0x0000000002F50000-0x0000000002F85000-memory.dmp

Download

memory/3724-139-0x00000000021C0000-0x00000000021F5000-memory.dmp

Download