emotet | 973ba287f7dfc43d784e86150b9770f7b0b2b76a2f8297e0403797a7cc976888

Analysis

Target
MVF1GWKhC146ycRAXp.dll
Size 432KB
Sample220401-k5llxahec3
SHA256 973ba287f7dfc43d784e86150b9770f7b0b2b76a2f8297e0403797a7cc976888
MD5 2752e35390844f06c22d0ce210144a37
SHA1 914b7147252baef3cc1e94cf0a15d7ff51f2dab3
SHA512 8e637d5a6b57d8d93cfbf1a7912eadebd93d02eff1406f8653b14fd1e9abe14b8d4d4ca381a6b25c6fd84c1068714c9e84c95143e406993977c3f822513b9418
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
4992	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lesrffcjgiiav\rwjzsr.sma	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4992	regsvr32.exe
4992	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2112	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2112	2912	regsvr32.exe	76
PID 2912 wrote to memory of 2112	2912	regsvr32.exe	76
PID 2912 wrote to memory of 2112	2912	regsvr32.exe	76
PID 2112 wrote to memory of 4992	2112	regsvr32.exe	77
PID 2112 wrote to memory of 4992	2112	regsvr32.exe	77
PID 2112 wrote to memory of 4992	2112	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MVF1GWKhC146ycRAXp.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\MVF1GWKhC146ycRAXp.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Lesrffcjgiiav\rwjzsr.sma"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4992

rwjzsr.sma

Path C:\Windows\SysWOW64\Lesrffcjgiiav\rwjzsr.sma
Size 432KB
SHA256 973ba287f7dfc43d784e86150b9770f7b0b2b76a2f8297e0403797a7cc976888
MD5 2752e35390844f06c22d0ce210144a37
SHA1 914b7147252baef3cc1e94cf0a15d7ff51f2dab3
SHA512 8e637d5a6b57d8d93cfbf1a7912eadebd93d02eff1406f8653b14fd1e9abe14b8d4d4ca381a6b25c6fd84c1068714c9e84c95143e406993977c3f822513b9418
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDXS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKXrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2112-126-0x0000000002420000-0x0000000002443000-memory.dmp

Download

memory/4992-130-0x0000000002320000-0x0000000002343000-memory.dmp

Download