emotet | ef0c7c1865ef5b96ec8696a876e80b6ab5f4becf79ca118be7df53f66078af6a

Analysis

Target
927af9c8f041d2535a5ede3ca7240e4c.dll
Size 480KB
Sample220404-ppf4psefc7
SHA256 ef0c7c1865ef5b96ec8696a876e80b6ab5f4becf79ca118be7df53f66078af6a
MD5 927af9c8f041d2535a5ede3ca7240e4c
SHA1 ff6004a2eba64a50a8679400693be507f1498a42
SHA512 e69ae52594b5117e703a0f9be40f4ad0117212fb268ebac1fe2993d6579bc68f9d6df36ef7f657a6249a6580ae8fe2ed2036c6377eaa49eea34934d9a7341931
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1792	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ympnnartbp\cmef.lax	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1792	regsvr32.exe
1792	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3580	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3580	4628	regsvr32.exe	79
PID 4628 wrote to memory of 3580	4628	regsvr32.exe	79
PID 4628 wrote to memory of 3580	4628	regsvr32.exe	79
PID 3580 wrote to memory of 1792	3580	regsvr32.exe	80
PID 3580 wrote to memory of 1792	3580	regsvr32.exe	80
PID 3580 wrote to memory of 1792	3580	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\927af9c8f041d2535a5ede3ca7240e4c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\927af9c8f041d2535a5ede3ca7240e4c.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ympnnartbp\cmef.lax"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1792

cmef.lax

Path C:\Windows\SysWOW64\Ympnnartbp\cmef.lax
Size 480KB
SHA256 ef0c7c1865ef5b96ec8696a876e80b6ab5f4becf79ca118be7df53f66078af6a
MD5 927af9c8f041d2535a5ede3ca7240e4c
SHA1 ff6004a2eba64a50a8679400693be507f1498a42
SHA512 e69ae52594b5117e703a0f9be40f4ad0117212fb268ebac1fe2993d6579bc68f9d6df36ef7f657a6249a6580ae8fe2ed2036c6377eaa49eea34934d9a7341931
SSDEEP 6144:XJDdcNtINDR6/qONZyPf71mOFFxFpkHPJM97sQHnJPFVkecjYxZCg1vqe3oz:XJDdWtINDccPf71v7zW2pzkjjib5qN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1792-130-0x00000000027A0000-0x00000000027C3000-memory.dmp

Download

memory/3580-125-0x0000000000EC0000-0x0000000000EE3000-memory.dmp

Download