emotet | 76dbb59e5bb2822cb43280fc732f323a27ea8af7feb2e3778d382d66675bfa5b

Analysis

Target
dae20c93d4a0a7204420f5bf7be827af.dll
Size 800KB
Sample220317-ndp2ssdbc4
SHA256 76dbb59e5bb2822cb43280fc732f323a27ea8af7feb2e3778d382d66675bfa5b
MD5 dae20c93d4a0a7204420f5bf7be827af
SHA1 fb2ac35578755753db962c2ae0c4aaa6d3778f98
SHA512 b917a371bb83fd1debbc047f2cc41d05e0bb520242aeecd19cc4c452a9c7a99bf49c222f52783ca00e7ddce1ff12794d25b19f1b081d266c2a45a3be2f162af3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Upfbcgslublsdwe\wsrrnletpwmi.jyp	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
680	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
756	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 1088 wrote to memory of 756	1088	regsvr32.exe	27
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28
PID 756 wrote to memory of 680	756	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dae20c93d4a0a7204420f5bf7be827af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dae20c93d4a0a7204420f5bf7be827af.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Upfbcgslublsdwe\wsrrnletpwmi.jyp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:680

memory/680-61-0x00000000009F0000-0x0000000000A3C000-memory.dmp

Download

memory/756-55-0x0000000075C41000-0x0000000075C43000-memory.dmp

Download

memory/756-56-0x0000000001F10000-0x0000000001F5C000-memory.dmp

Download

memory/1088-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Download