emotet | 8b50b9c59c8398e98cff65cfee8791679e9c3ee7ba621ed3dad869f2aefa13fb

Analysis

Target
3c0705fb57e8ceafa47cfc1b49f49d14.dll
Size 796KB
Sample220317-lkyleacgh4
SHA256 8b50b9c59c8398e98cff65cfee8791679e9c3ee7ba621ed3dad869f2aefa13fb
MD5 3c0705fb57e8ceafa47cfc1b49f49d14
SHA1 6cd13f06f028684a1597115f08afa663d0ac10e7
SHA512 878a8bfe2df18b47c832ae58d3da479c88a39755560b1b8f9196d11b5e41ab1c24379c14617091df1af911f1e31bb808cb17f6ceb634db397716ffe3efe70c3d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
4680	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Uoueqczwthvif\athvq.yic	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4680	regsvr32.exe
4680	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4448	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4448	4692	regsvr32.exe	82
PID 4692 wrote to memory of 4448	4692	regsvr32.exe	82
PID 4692 wrote to memory of 4448	4692	regsvr32.exe	82
PID 4448 wrote to memory of 4680	4448	regsvr32.exe	83
PID 4448 wrote to memory of 4680	4448	regsvr32.exe	83
PID 4448 wrote to memory of 4680	4448	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c0705fb57e8ceafa47cfc1b49f49d14.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3c0705fb57e8ceafa47cfc1b49f49d14.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Uoueqczwthvif\athvq.yic"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4680

memory/4448-134-0x0000000002E10000-0x0000000002E5D000-memory.dmp

Download

memory/4680-139-0x0000000002600000-0x000000000264D000-memory.dmp

Download