emotet | 4230dc850a0506a29d16dfd0f6336d8719fff7fe62d21b1ae6771ae90c58c1ce

Analysis

Target
5dcddcd3d3e4d9e96e9ec97dca2fa5ff.dll
Size 528KB
Sample220401-affz1sbee4
SHA256 4230dc850a0506a29d16dfd0f6336d8719fff7fe62d21b1ae6771ae90c58c1ce
MD5 5dcddcd3d3e4d9e96e9ec97dca2fa5ff
SHA1 077d6efbdc09cd0a7f4fced678ba159fd407377b
SHA512 0dcc5a3a1f2582a65190f60778bddcd52ef2ca5f6a126556d31ca6f3bfeb12749f2296492d61d065e35bdbed854971ce610a7745bc2fbd0f81f30726bb73cc33
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3240	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zmpgdht\obvmdmme.fey	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3240	regsvr32.exe
3240	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1132	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1132	872	regsvr32.exe	76
PID 872 wrote to memory of 1132	872	regsvr32.exe	76
PID 872 wrote to memory of 1132	872	regsvr32.exe	76
PID 1132 wrote to memory of 3240	1132	regsvr32.exe	77
PID 1132 wrote to memory of 3240	1132	regsvr32.exe	77
PID 1132 wrote to memory of 3240	1132	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5dcddcd3d3e4d9e96e9ec97dca2fa5ff.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5dcddcd3d3e4d9e96e9ec97dca2fa5ff.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Zmpgdht\obvmdmme.fey"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3240

obvmdmme.fey

Path C:\Windows\SysWOW64\Zmpgdht\obvmdmme.fey
Size 528KB
SHA256 4230dc850a0506a29d16dfd0f6336d8719fff7fe62d21b1ae6771ae90c58c1ce
MD5 5dcddcd3d3e4d9e96e9ec97dca2fa5ff
SHA1 077d6efbdc09cd0a7f4fced678ba159fd407377b
SHA512 0dcc5a3a1f2582a65190f60778bddcd52ef2ca5f6a126556d31ca6f3bfeb12749f2296492d61d065e35bdbed854971ce610a7745bc2fbd0f81f30726bb73cc33
SSDEEP 6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQBJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWzPDIsogYLTtQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-126-0x0000000002630000-0x0000000002653000-memory.dmp

Download

memory/3240-130-0x0000000002C50000-0x0000000002C73000-memory.dmp

Download