emotet | 67d002fb1384095980f3e31545686a10fa9ea44f0c74f96972cffbe7b8aae719

Analysis

Target
70fe7370e0d3a012d3f3d000b5c931b2.dll
Size 432KB
Sample220401-kw6kqahch9
SHA256 67d002fb1384095980f3e31545686a10fa9ea44f0c74f96972cffbe7b8aae719
MD5 70fe7370e0d3a012d3f3d000b5c931b2
SHA1 74b764998b676db231859b8cc76f984178d98afa
SHA512 e3cd20b820fc9b42615820c44433263ec4e2c062b57e3a519f182a8b97c587e8d7467db2bd925171176839d77cfc02cb38fb294be4c6b2c771e5758ab8fde120
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2832	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Inxkvxn\ikmdzxazenay.inl	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	regsvr32.exe
2832	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4656	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4656	5116	regsvr32.exe	76
PID 5116 wrote to memory of 4656	5116	regsvr32.exe	76
PID 5116 wrote to memory of 4656	5116	regsvr32.exe	76
PID 4656 wrote to memory of 2832	4656	regsvr32.exe	77
PID 4656 wrote to memory of 2832	4656	regsvr32.exe	77
PID 4656 wrote to memory of 2832	4656	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\70fe7370e0d3a012d3f3d000b5c931b2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\70fe7370e0d3a012d3f3d000b5c931b2.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Inxkvxn\ikmdzxazenay.inl"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2832

ikmdzxazenay.inl

Path C:\Windows\SysWOW64\Inxkvxn\ikmdzxazenay.inl
Size 432KB
SHA256 67d002fb1384095980f3e31545686a10fa9ea44f0c74f96972cffbe7b8aae719
MD5 70fe7370e0d3a012d3f3d000b5c931b2
SHA1 74b764998b676db231859b8cc76f984178d98afa
SHA512 e3cd20b820fc9b42615820c44433263ec4e2c062b57e3a519f182a8b97c587e8d7467db2bd925171176839d77cfc02cb38fb294be4c6b2c771e5758ab8fde120
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDGS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKyrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2832-130-0x0000000002560000-0x0000000002583000-memory.dmp

Download

memory/4656-126-0x0000000002870000-0x0000000002893000-memory.dmp

Download