emotet | 18ed546e8ff778508617aa7b92d903b6acafdca66eca3a40ee6a21e25bbaf377

Analysis

Target
7bcf1c9e9dfc561a0f0aec52eb59dac9.dll
Size 432KB
Sample220401-xtr1rscabk
SHA256 18ed546e8ff778508617aa7b92d903b6acafdca66eca3a40ee6a21e25bbaf377
MD5 7bcf1c9e9dfc561a0f0aec52eb59dac9
SHA1 667736f2f6ef2388a8b29dc008ab634384e5be28
SHA512 ec6b1bdf7c7e94316404ebff8351eb5c9105aa7a683cbec399d6c9b050916184c8afe677636e47e702dac0add9299bf1eaa951e3db4c9a6446f7e15ef7676e0d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
4852	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zlihtcjjjvzgojf\wnvsdxteaz.lqu	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	regsvr32.exe
4852	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3112	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3112	2764	regsvr32.exe	76
PID 2764 wrote to memory of 3112	2764	regsvr32.exe	76
PID 2764 wrote to memory of 3112	2764	regsvr32.exe	76
PID 3112 wrote to memory of 4852	3112	regsvr32.exe	77
PID 3112 wrote to memory of 4852	3112	regsvr32.exe	77
PID 3112 wrote to memory of 4852	3112	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7bcf1c9e9dfc561a0f0aec52eb59dac9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7bcf1c9e9dfc561a0f0aec52eb59dac9.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Zlihtcjjjvzgojf\wnvsdxteaz.lqu"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4852

wnvsdxteaz.lqu

Path C:\Windows\SysWOW64\Zlihtcjjjvzgojf\wnvsdxteaz.lqu
Size 432KB
SHA256 18ed546e8ff778508617aa7b92d903b6acafdca66eca3a40ee6a21e25bbaf377
MD5 7bcf1c9e9dfc561a0f0aec52eb59dac9
SHA1 667736f2f6ef2388a8b29dc008ab634384e5be28
SHA512 ec6b1bdf7c7e94316404ebff8351eb5c9105aa7a683cbec399d6c9b050916184c8afe677636e47e702dac0add9299bf1eaa951e3db4c9a6446f7e15ef7676e0d
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDiS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKersjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3112-125-0x0000000002340000-0x0000000002363000-memory.dmp

Download

memory/4852-130-0x0000000002A60000-0x0000000002A83000-memory.dmp

Download