emotet | 9b6f0340dda2419c41e6c42b03eae26350589db85fa5bee54cf5d79b54d7ebfc

Analysis

Target
48d4452b9089bddb05ca86f96802954a.dll
Size 664KB
Sample220316-tehl1afbe7
SHA256 9b6f0340dda2419c41e6c42b03eae26350589db85fa5bee54cf5d79b54d7ebfc
MD5 48d4452b9089bddb05ca86f96802954a
SHA1 727d6e609e7a77fde643760e4ce7cc9e4a817dcb
SHA512 ac0809c7408244743fcbd0e9023a81eaf5f4f70e5ece94148ac6d5ce77eb15869923f67b9fe74047b278e67fdff75699cdbf57dbfaf0522e76da3e9c3cb33e99
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
4416	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ajbntckiqb\croznhtb.tsf	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4416	regsvr32.exe
4416	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3672	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3672	3496	regsvr32.exe	82
PID 3496 wrote to memory of 3672	3496	regsvr32.exe	82
PID 3496 wrote to memory of 3672	3496	regsvr32.exe	82
PID 3672 wrote to memory of 4416	3672	regsvr32.exe	88
PID 3672 wrote to memory of 4416	3672	regsvr32.exe	88
PID 3672 wrote to memory of 4416	3672	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\48d4452b9089bddb05ca86f96802954a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\48d4452b9089bddb05ca86f96802954a.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ajbntckiqb\croznhtb.tsf"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4416

memory/3672-134-0x0000000002940000-0x0000000002974000-memory.dmp

Download

memory/4416-139-0x0000000002800000-0x0000000002834000-memory.dmp

Download