emotet | 862d60ce76aef39349543946bac63d368ec3bcc3c6e3dfe0eeaa9af76e7e2d8f

Analysis

Target
ab7a1fd04f55ce05ac25cc815d6d9dc8.dll
Size 528KB
Sample220401-jvd9eagfe3
SHA256 862d60ce76aef39349543946bac63d368ec3bcc3c6e3dfe0eeaa9af76e7e2d8f
MD5 ab7a1fd04f55ce05ac25cc815d6d9dc8
SHA1 1e4445a2bf66f402a5da592c1627ebae5eb8a5db
SHA512 9b0f388bceebf3ebfca6b3be8caa25f956dce821792f8bd0084c3d732961c9eff867b9ec3bc66d5fc0aad1f511f054772430c4465d4301d00228bf12098e0e25
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1480	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gwgqjaxduhy\vlebh.orb	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1480	regsvr32.exe
1480	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1528	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1528	1824	regsvr32.exe	76
PID 1824 wrote to memory of 1528	1824	regsvr32.exe	76
PID 1824 wrote to memory of 1528	1824	regsvr32.exe	76
PID 1528 wrote to memory of 1480	1528	regsvr32.exe	77
PID 1528 wrote to memory of 1480	1528	regsvr32.exe	77
PID 1528 wrote to memory of 1480	1528	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab7a1fd04f55ce05ac25cc815d6d9dc8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ab7a1fd04f55ce05ac25cc815d6d9dc8.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Gwgqjaxduhy\vlebh.orb"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1480

vlebh.orb

Path C:\Windows\SysWOW64\Gwgqjaxduhy\vlebh.orb
Size 528KB
SHA256 862d60ce76aef39349543946bac63d368ec3bcc3c6e3dfe0eeaa9af76e7e2d8f
MD5 ab7a1fd04f55ce05ac25cc815d6d9dc8
SHA1 1e4445a2bf66f402a5da592c1627ebae5eb8a5db
SHA512 9b0f388bceebf3ebfca6b3be8caa25f956dce821792f8bd0084c3d732961c9eff867b9ec3bc66d5fc0aad1f511f054772430c4465d4301d00228bf12098e0e25
SSDEEP 6144:NEHZqt2fGTf17ZWi4QWVhvqlEvQTJuSReK/0D0kGsoanL/whFTSQFZ9xVu0EY:C0AGj17ZWi4QWztDIsogYLTtQZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-130-0x00000000026E0000-0x0000000002703000-memory.dmp

Download

memory/1528-125-0x00000000024F0000-0x0000000002513000-memory.dmp

Download