emotet | ca13b9b08bbd14f84e6d47f29a44fa3d38ae71f73fa6714896fd1b22b9472df5

Analysis

Target
0ed546b7f1892178e795bd592c5568ef.dll
Size 664KB
Sample220316-sflvdadbfn
SHA256 ca13b9b08bbd14f84e6d47f29a44fa3d38ae71f73fa6714896fd1b22b9472df5
MD5 0ed546b7f1892178e795bd592c5568ef
SHA1 bb6153f2392cb1efcaf2b330944014f2efc5185c
SHA512 cc4865915ac79fbf176b0d72056884fc03162ab0993e4260bb193be108c6fc5e38afa58d974b57673cc72f6761bf4bf80f616e7fe1709c6d9a43866d046c1f1f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
4072	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fsonfpeege\jpxlufjsaudww.zrv	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	regsvr32.exe
4072	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1172	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1172	4548	regsvr32.exe	82
PID 4548 wrote to memory of 1172	4548	regsvr32.exe	82
PID 4548 wrote to memory of 1172	4548	regsvr32.exe	82
PID 1172 wrote to memory of 4072	1172	regsvr32.exe	90
PID 1172 wrote to memory of 4072	1172	regsvr32.exe	90
PID 1172 wrote to memory of 4072	1172	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ed546b7f1892178e795bd592c5568ef.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0ed546b7f1892178e795bd592c5568ef.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Fsonfpeege\jpxlufjsaudww.zrv"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4072

memory/1172-134-0x0000000002530000-0x0000000002564000-memory.dmp

Download

memory/4072-139-0x0000000002D00000-0x0000000002D34000-memory.dmp

Download