emotet | 0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2

Analysis

Target
emotet_exe_e5_0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2_2022-03-17__214456.dll
Size 780KB
Sample220317-1mba8afcb7
SHA256 0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2
MD5 4303888466f550227244b4a88e81360f
SHA1 974a611f7d3938041d53ee4321e7c7a414613252
SHA512 615c23f48059ee7649456d4d65caf328852798cd6cb887ac2a53bc77ffca2386700000868859a8c51a5c2f9532d3635fd60497995d59783d7759a4f66fd41a61
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/1484-134-0x00000000023C0000-0x000000000240C000-memory.dmp	Emotet4
behavioral2/memory/3724-139-0x0000000002850000-0x000000000289C000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
3724	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drijqhbiztnkbhv\biyyqp.mko	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	regsvr32.exe
3724	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1484	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1484	2592	regsvr32.exe	82
PID 2592 wrote to memory of 1484	2592	regsvr32.exe	82
PID 2592 wrote to memory of 1484	2592	regsvr32.exe	82
PID 1484 wrote to memory of 3724	1484	regsvr32.exe	86
PID 1484 wrote to memory of 3724	1484	regsvr32.exe	86
PID 1484 wrote to memory of 3724	1484	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2_2022-03-17__214456.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2_2022-03-17__214456.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Drijqhbiztnkbhv\biyyqp.mko"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3724

memory/1484-134-0x00000000023C0000-0x000000000240C000-memory.dmp

Download

memory/3724-139-0x0000000002850000-0x000000000289C000-memory.dmp

Download