emotet | 963002f0b72426ae5eb3db9ebef095c6525a3143d336f665aea47e05fa22b5e1

Analysis

Target
xcah1.dll
Size 432KB
Sample220401-xn68habhek
SHA256 963002f0b72426ae5eb3db9ebef095c6525a3143d336f665aea47e05fa22b5e1
MD5 f9b64b4faf4d7563809c55665120426a
SHA1 a54f1d8f7c60418a637b4c9e01f8b1fc0ed1b435
SHA512 2ae34776401bf821a4e2ff1c263f8fed1dbd9f31920a55f2d163d8914c712c81add28229a85d80fb70419130a23e427e233fd2102548ebf1369d7c8f1f5f14c8
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
4348	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Daqup\ogpnt.ytk	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	regsvr32.exe
4348	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
664	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 664	4100	regsvr32.exe	76
PID 4100 wrote to memory of 664	4100	regsvr32.exe	76
PID 4100 wrote to memory of 664	4100	regsvr32.exe	76
PID 664 wrote to memory of 4348	664	regsvr32.exe	77
PID 664 wrote to memory of 4348	664	regsvr32.exe	77
PID 664 wrote to memory of 4348	664	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xcah1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xcah1.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:664
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Daqup\ogpnt.ytk"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4348

ogpnt.ytk

Path C:\Windows\SysWOW64\Daqup\ogpnt.ytk
Size 432KB
SHA256 963002f0b72426ae5eb3db9ebef095c6525a3143d336f665aea47e05fa22b5e1
MD5 f9b64b4faf4d7563809c55665120426a
SHA1 a54f1d8f7c60418a637b4c9e01f8b1fc0ed1b435
SHA512 2ae34776401bf821a4e2ff1c263f8fed1dbd9f31920a55f2d163d8914c712c81add28229a85d80fb70419130a23e427e233fd2102548ebf1369d7c8f1f5f14c8
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDvS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzK/rsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/664-125-0x0000000001660000-0x0000000001683000-memory.dmp

Download

memory/4348-130-0x0000000003040000-0x0000000003063000-memory.dmp

Download