emotet | 2bcadebccd04288377e2d0d992da95317eeb57204cfcfb857e2b52935ed457c2

Analysis

Target
848bc4a085b0017a4ad19b3d9ec95733.dll
Size 432KB
Sample220401-lrl6yshhc9
SHA256 2bcadebccd04288377e2d0d992da95317eeb57204cfcfb857e2b52935ed457c2
MD5 848bc4a085b0017a4ad19b3d9ec95733
SHA1 563e292e8d1c30b0b631726190ec187f08592e81
SHA512 9b8f0dae7b54583a6c2e7e7108708cfb6aa82de95dba6a28ddd818c14da000e5546b84cb72d4a2e31d505721be89ffd2c42b8110d12a91d0aee3e2dc3521a1ef
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1676	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dudafdlpkfy\hsjb.kts	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	regsvr32.exe
1676	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1012	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1012	1292	regsvr32.exe	76
PID 1292 wrote to memory of 1012	1292	regsvr32.exe	76
PID 1292 wrote to memory of 1012	1292	regsvr32.exe	76
PID 1012 wrote to memory of 1676	1012	regsvr32.exe	77
PID 1012 wrote to memory of 1676	1012	regsvr32.exe	77
PID 1012 wrote to memory of 1676	1012	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\848bc4a085b0017a4ad19b3d9ec95733.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\848bc4a085b0017a4ad19b3d9ec95733.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Dudafdlpkfy\hsjb.kts"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1676

hsjb.kts

Path C:\Windows\SysWOW64\Dudafdlpkfy\hsjb.kts
Size 432KB
SHA256 2bcadebccd04288377e2d0d992da95317eeb57204cfcfb857e2b52935ed457c2
MD5 848bc4a085b0017a4ad19b3d9ec95733
SHA1 563e292e8d1c30b0b631726190ec187f08592e81
SHA512 9b8f0dae7b54583a6c2e7e7108708cfb6aa82de95dba6a28ddd818c14da000e5546b84cb72d4a2e31d505721be89ffd2c42b8110d12a91d0aee3e2dc3521a1ef
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKD7S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKDrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1012-125-0x0000000002A20000-0x0000000002A43000-memory.dmp

Download

memory/1676-130-0x0000000000B30000-0x0000000000B53000-memory.dmp

Download