emotet | 95e103c95d67a29d7eb873d94517b23469d47a7ef3f71be6c4eec787fab9b3ab

Analysis

Target
60cc72f191847e1e4a79aa11fc411f44.dll
Size 800KB
Sample220317-v3p7esdce6
SHA256 95e103c95d67a29d7eb873d94517b23469d47a7ef3f71be6c4eec787fab9b3ab
MD5 60cc72f191847e1e4a79aa11fc411f44
SHA1 6cd64b00c4aeee3d2a816db42bd9e6f2646d1640
SHA512 53d46568da69263eec5c588aba72513be23c400852113cd54e861cce60f2cc00f61ecd519c7fcfa02e99d29662156e2b4b056b6951756174b110fc0275478054
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Emotet4 2 IoCs

resource	yara_rule
behavioral2/memory/1324-134-0x0000000002490000-0x00000000024DC000-memory.dmp	Emotet4
behavioral2/memory/3896-139-0x0000000002CA0000-0x0000000002CEC000-memory.dmp	Emotet4

Loads dropped DLL 1 IoCs

pid	Process
3896	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Moqdvbcpyq\wwoyjk.ahp	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3896	regsvr32.exe
3896	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1324	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1324	1236	regsvr32.exe	82
PID 1236 wrote to memory of 1324	1236	regsvr32.exe	82
PID 1236 wrote to memory of 1324	1236	regsvr32.exe	82
PID 1324 wrote to memory of 3896	1324	regsvr32.exe	83
PID 1324 wrote to memory of 3896	1324	regsvr32.exe	83
PID 1324 wrote to memory of 3896	1324	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\60cc72f191847e1e4a79aa11fc411f44.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\60cc72f191847e1e4a79aa11fc411f44.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Moqdvbcpyq\wwoyjk.ahp"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3896

memory/1324-134-0x0000000002490000-0x00000000024DC000-memory.dmp

Download

memory/3896-139-0x0000000002CA0000-0x0000000002CEC000-memory.dmp

Download