emotet | 277b462c0357f92b040d33a13e7025f4d8f645cfff99d53b7fe3b0d3ac539601

Analysis

Target
cc78fc992514627a9072bd67f8f2e516.dll
Size 732KB
Sample220316-y5jzzaecdp
SHA256 277b462c0357f92b040d33a13e7025f4d8f645cfff99d53b7fe3b0d3ac539601
MD5 cc78fc992514627a9072bd67f8f2e516
SHA1 4c9ccf822ff3b07f940754bb593820b4d518905f
SHA512 180e0979084b761a3cd4e81735978fe0223f5fe42ce986f43a03d54ceee34d8fbb323a93f65f894c8835ff80798d918098b19571dea9d92a0cc3ef2ed4beefbc
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Loeilnnfut\zhsvlgowtzh.kmm	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
912	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
964	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 948 wrote to memory of 964	948	regsvr32.exe	27
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30
PID 964 wrote to memory of 912	964	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc78fc992514627a9072bd67f8f2e516.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cc78fc992514627a9072bd67f8f2e516.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Loeilnnfut\zhsvlgowtzh.kmm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:912

memory/912-61-0x0000000000980000-0x00000000009B4000-memory.dmp

Download

memory/948-54-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmp

Download

memory/964-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/964-56-0x00000000002C0000-0x00000000002F4000-memory.dmp

Download