emotet | 1baa209e2a4686bf6494aa3283102ae691679fd60d260db76f7f9f30e52c1b48

Analysis

Target
9315f7f47c7f4020134799d6089bdd7e.dll
Size 664KB
Sample220316-v5fe1afec3
SHA256 1baa209e2a4686bf6494aa3283102ae691679fd60d260db76f7f9f30e52c1b48
MD5 9315f7f47c7f4020134799d6089bdd7e
SHA1 337d821e2389417af53bd681de9873e59c4c2a0a
SHA512 444f8aae548d0fa751b51b971a9284c03c4e7cc73eb9c2fcc02f8225b44669b59e441503d5e7a88aa6d79cb462e53304b59d0fe70796a9de054fa5c61b7cd963
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1288	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kwshcbxo\acdlredhizlp.knx	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1288	regsvr32.exe
1288	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2128	1856	regsvr32.exe	82
PID 1856 wrote to memory of 2128	1856	regsvr32.exe	82
PID 1856 wrote to memory of 2128	1856	regsvr32.exe	82
PID 2128 wrote to memory of 1288	2128	regsvr32.exe	83
PID 2128 wrote to memory of 1288	2128	regsvr32.exe	83
PID 2128 wrote to memory of 1288	2128	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9315f7f47c7f4020134799d6089bdd7e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9315f7f47c7f4020134799d6089bdd7e.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kwshcbxo\acdlredhizlp.knx"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1288

memory/1288-139-0x0000000002DC0000-0x0000000002DF4000-memory.dmp

Download

memory/2128-135-0x0000000002FB0000-0x0000000002FE4000-memory.dmp

Download