emotet | 9d6ece7f4f1439bef7e7db2f2bf36567c62fb3371df111fdc903ce639b106d28

Analysis

Target
fadc005659b6018e5b6c478cffa95cf7.dll
Size 800KB
Sample220317-pex98sded2
SHA256 9d6ece7f4f1439bef7e7db2f2bf36567c62fb3371df111fdc903ce639b106d28
MD5 fadc005659b6018e5b6c478cffa95cf7
SHA1 cc965e547b3d93cce070e62000aefed1ec4e7d7a
SHA512 3121a7fb973536e1fd3d4e2120ff6d30390b11000b7650911e3a48997661d2552c475618ea08fb0d454bcef825f6051910ec1adfcedc8a55be5d277cc169271d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Txfwkjtrptgujv\orsa.dek	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
772	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1888 wrote to memory of 1092	1888	regsvr32.exe	27
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28
PID 1092 wrote to memory of 772	1092	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fadc005659b6018e5b6c478cffa95cf7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fadc005659b6018e5b6c478cffa95cf7.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Txfwkjtrptgujv\orsa.dek"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:772

memory/772-61-0x00000000007E0000-0x000000000082C000-memory.dmp

Download

memory/1092-55-0x0000000074F31000-0x0000000074F33000-memory.dmp

Download

memory/1092-56-0x0000000000A40000-0x0000000000A8C000-memory.dmp

Download

memory/1888-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Download