emotet | 76dbb59e5bb2822cb43280fc732f323a27ea8af7feb2e3778d382d66675bfa5b

Analysis

Target
dae20c93d4a0a7204420f5bf7be827af.dll
Size 800KB
Sample220317-ndp2ssdbc4
SHA256 76dbb59e5bb2822cb43280fc732f323a27ea8af7feb2e3778d382d66675bfa5b
MD5 dae20c93d4a0a7204420f5bf7be827af
SHA1 fb2ac35578755753db962c2ae0c4aaa6d3778f98
SHA512 b917a371bb83fd1debbc047f2cc41d05e0bb520242aeecd19cc4c452a9c7a99bf49c222f52783ca00e7ddce1ff12794d25b19f1b081d266c2a45a3be2f162af3
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3712	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lqmxyzewbnramm\aykktseukmqwzr.gbl	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3712	regsvr32.exe
3712	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4532	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4532	4476	regsvr32.exe	82
PID 4476 wrote to memory of 4532	4476	regsvr32.exe	82
PID 4476 wrote to memory of 4532	4476	regsvr32.exe	82
PID 4532 wrote to memory of 3712	4532	regsvr32.exe	89
PID 4532 wrote to memory of 3712	4532	regsvr32.exe	89
PID 4532 wrote to memory of 3712	4532	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dae20c93d4a0a7204420f5bf7be827af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dae20c93d4a0a7204420f5bf7be827af.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Lqmxyzewbnramm\aykktseukmqwzr.gbl"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3712

memory/3712-139-0x0000000002DF0000-0x0000000002E3C000-memory.dmp

Download

memory/4532-134-0x0000000002300000-0x000000000234C000-memory.dmp

Download