emotet | bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af

Analysis

Target
emotet_exe_e4_bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af_2022-03-16__164823.dll
Size 736KB
Sample220316-vbnjhsdedp
SHA256 bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af
MD5 0ce7ece1eb7f478377ac9d492d0a8ef3
SHA1 628c06a5b0706b0fa31a5cf5dd2749e77ffd1fb3
SHA512 d8bd82cbb12e6e2daec007ed02c80269dcafd8d3fde194c5c5d951f825196aa0f83d7338ae4422a7fc965ec617c1a9aad7ae27322f11cad2773709dc9972928f
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
3820	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Azphafstz\zwlbyunrbhlopxj.djs	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3820	regsvr32.exe
3820	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3112	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3112	4852	regsvr32.exe	83
PID 4852 wrote to memory of 3112	4852	regsvr32.exe	83
PID 4852 wrote to memory of 3112	4852	regsvr32.exe	83
PID 3112 wrote to memory of 3820	3112	regsvr32.exe	89
PID 3112 wrote to memory of 3820	3112	regsvr32.exe	89
PID 3112 wrote to memory of 3820	3112	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af_2022-03-16__164823.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af_2022-03-16__164823.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Azphafstz\zwlbyunrbhlopxj.djs"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3820

memory/3112-134-0x0000000002290000-0x00000000022C5000-memory.dmp

Download

memory/3820-139-0x0000000002F90000-0x0000000002FC5000-memory.dmp

Download