emotet | ec246b4eacc5c4534a824056314fb6300842b83732cc1252e881c6409eec29a1

Analysis

Target
2e4a1264a3478aaa033c3b017eb800e5.dll
Size 528KB
Sample220331-3bdy3sbbb2
SHA256 ec246b4eacc5c4534a824056314fb6300842b83732cc1252e881c6409eec29a1
MD5 2e4a1264a3478aaa033c3b017eb800e5
SHA1 f59839cbd0c8e7b9d00e25f0ab3a5332aa3a8c5d
SHA512 c3413c66d92e4d5274ec8fa0dcbc594cbf54d97ae0f9bae5d60c957246aa37c0d8cb7360088c3317a417f4fc7beba0d41ca35d126f5b08d842acd6cc4010c6ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1132	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Xdrftoassnzg\wobnn.agz	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	regsvr32.exe
1132	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5104	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5104	5092	regsvr32.exe	76
PID 5092 wrote to memory of 5104	5092	regsvr32.exe	76
PID 5092 wrote to memory of 5104	5092	regsvr32.exe	76
PID 5104 wrote to memory of 1132	5104	regsvr32.exe	77
PID 5104 wrote to memory of 1132	5104	regsvr32.exe	77
PID 5104 wrote to memory of 1132	5104	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e4a1264a3478aaa033c3b017eb800e5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e4a1264a3478aaa033c3b017eb800e5.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Xdrftoassnzg\wobnn.agz"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1132

wobnn.agz

Path C:\Windows\SysWOW64\Xdrftoassnzg\wobnn.agz
Size 528KB
SHA256 ec246b4eacc5c4534a824056314fb6300842b83732cc1252e881c6409eec29a1
MD5 2e4a1264a3478aaa033c3b017eb800e5
SHA1 f59839cbd0c8e7b9d00e25f0ab3a5332aa3a8c5d
SHA512 c3413c66d92e4d5274ec8fa0dcbc594cbf54d97ae0f9bae5d60c957246aa37c0d8cb7360088c3317a417f4fc7beba0d41ca35d126f5b08d842acd6cc4010c6ef
SSDEEP 6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQUJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzMDIsogYLTtQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-130-0x0000000002730000-0x0000000002753000-memory.dmp

Download

memory/5104-125-0x0000000001260000-0x0000000001283000-memory.dmp

Download