emotet | 8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61

Analysis

Target
emotet_exe_e4_8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61_2022-03-17__084608.dll
Size 796KB
Sample220317-kpvvmscfb7
SHA256 8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61
MD5 3ac5e788b519454031dbf40fa69ca708
SHA1 986a0e58ea43b3db2b66aa5e1d5f1c7cb2fc368e
SHA512 9f0a68b78d333ba7a3c892dec32202054c94b30fbd6b398910fc9523f1d9bd7e762131bd2ae3baa02dfb96f18044c8440d43affd5b03eb7d199cc33e7e6ce1e7
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1248	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pbuvw\gjjryjqpbzhbrat.mxe	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1248	regsvr32.exe
1248	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5012	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5012	4860	regsvr32.exe	81
PID 4860 wrote to memory of 5012	4860	regsvr32.exe	81
PID 4860 wrote to memory of 5012	4860	regsvr32.exe	81
PID 5012 wrote to memory of 1248	5012	regsvr32.exe	84
PID 5012 wrote to memory of 1248	5012	regsvr32.exe	84
PID 5012 wrote to memory of 1248	5012	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61_2022-03-17__084608.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61_2022-03-17__084608.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Pbuvw\gjjryjqpbzhbrat.mxe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1248

memory/1248-139-0x0000000002E80000-0x0000000002ECD000-memory.dmp

Download

memory/5012-134-0x0000000002C60000-0x0000000002CAD000-memory.dmp

Download