emotet | b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b

Analysis

Target
lumber.dll
Size 840KB
Sample220401-g4w5gafch3
SHA256 b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b
MD5 bb70b179711d5b9cf578a87d3d75e56f
SHA1 dbeea2d972f1cf5f39baeb7b1c5bffc3da38c520
SHA512 90b653a185c3ed72df5118c72ee995e257997824158a357eda3fe745fd9a25e4aa446042b8db0532c2cc7b482a51084122894b565ebff00f7da2c42d5b288351
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2628	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Vgwrwrwnloxlxxx\pjxpyhruqk.pjd	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2628	regsvr32.exe
2628	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4028	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4028	1372	regsvr32.exe	76
PID 1372 wrote to memory of 4028	1372	regsvr32.exe	76
PID 1372 wrote to memory of 4028	1372	regsvr32.exe	76
PID 4028 wrote to memory of 2628	4028	regsvr32.exe	77
PID 4028 wrote to memory of 2628	4028	regsvr32.exe	77
PID 4028 wrote to memory of 2628	4028	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\lumber.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\lumber.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Vgwrwrwnloxlxxx\pjxpyhruqk.pjd"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2628

pjxpyhruqk.pjd

Path C:\Windows\SysWOW64\Vgwrwrwnloxlxxx\pjxpyhruqk.pjd
Size 840KB
SHA256 b26276e62cdaa6ecc810c1c66ef5fb7a78fc78e2db5c3fa85ab52a7c7da4dc3b
MD5 bb70b179711d5b9cf578a87d3d75e56f
SHA1 dbeea2d972f1cf5f39baeb7b1c5bffc3da38c520
SHA512 90b653a185c3ed72df5118c72ee995e257997824158a357eda3fe745fd9a25e4aa446042b8db0532c2cc7b482a51084122894b565ebff00f7da2c42d5b288351
SSDEEP 12288:iKJCPjp1g4SbBKilbUD4/mQjcQ6JC3s5cYL:yPjp1g4S11lgDoRAQAcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2628-130-0x00000000026C0000-0x00000000026E3000-memory.dmp

Download

memory/4028-125-0x0000000001150000-0x0000000001173000-memory.dmp

Download