emotet | 9a18cee99d4c0ea53cbecdc0374a2d3ecd7da0634559fea0522258e766d635ae

Analysis

Target
06b4511777c9f66ba12bbded0bf26f11.dll
Size 432KB
Sample220401-wdej3afaf3
SHA256 9a18cee99d4c0ea53cbecdc0374a2d3ecd7da0634559fea0522258e766d635ae
MD5 06b4511777c9f66ba12bbded0bf26f11
SHA1 2c113827d71251ec12cd249890d93129a06b3092
SHA512 e3e6346cd1fc4ff38300f028271cad5fcad3244506db34367bb88b7b6d273fa79999608a5fca38b27d4f6dddaf5e6e01cca7536a8452b1ca1cb1454d565e8665
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2808	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kibaircpprfugx\ekgctofqneziiv.aoe	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	regsvr32.exe
2808	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2288	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 2288	1104	regsvr32.exe	76
PID 1104 wrote to memory of 2288	1104	regsvr32.exe	76
PID 1104 wrote to memory of 2288	1104	regsvr32.exe	76
PID 2288 wrote to memory of 2808	2288	regsvr32.exe	77
PID 2288 wrote to memory of 2808	2288	regsvr32.exe	77
PID 2288 wrote to memory of 2808	2288	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06b4511777c9f66ba12bbded0bf26f11.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06b4511777c9f66ba12bbded0bf26f11.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Kibaircpprfugx\ekgctofqneziiv.aoe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2808

ekgctofqneziiv.aoe

Path C:\Windows\SysWOW64\Kibaircpprfugx\ekgctofqneziiv.aoe
Size 432KB
SHA256 9a18cee99d4c0ea53cbecdc0374a2d3ecd7da0634559fea0522258e766d635ae
MD5 06b4511777c9f66ba12bbded0bf26f11
SHA1 2c113827d71251ec12cd249890d93129a06b3092
SHA512 e3e6346cd1fc4ff38300f028271cad5fcad3244506db34367bb88b7b6d273fa79999608a5fca38b27d4f6dddaf5e6e01cca7536a8452b1ca1cb1454d565e8665
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKD3S4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKvrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2288-125-0x00000000005C0000-0x00000000005E3000-memory.dmp

Download

memory/2808-130-0x00000000005F0000-0x0000000000613000-memory.dmp

Download