emotet | b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b

Analysis

Target
lumber.dll
Size 840KB
Sample220401-g4w5gafch3
SHA256 b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b
MD5 bb70b179711d5b9cf578a87d3d75e56f
SHA1 dbeea2d972f1cf5f39baeb7b1c5bffc3da38c520
SHA512 90b653a185c3ed72df5118c72ee995e257997824158a357eda3fe745fd9a25e4aa446042b8db0532c2cc7b482a51084122894b565ebff00f7da2c42d5b288351
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Vpgbvzp\wvxoj.gvo	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1688	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1720	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 2032 wrote to memory of 1720	2032	regsvr32.exe	28
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29
PID 1720 wrote to memory of 1688	1720	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lumber.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lumber.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vpgbvzp\wvxoj.gvo"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1688

memory/1688-62-0x0000000000130000-0x0000000000153000-memory.dmp

Download

memory/1720-56-0x00000000754A1000-0x00000000754A3000-memory.dmp

Download

memory/1720-57-0x0000000000270000-0x0000000000293000-memory.dmp

Download

memory/2032-54-0x000007FEFB5A1000-0x000007FEFB5A3000-memory.dmp

Download