emotet | 3afb4ff25f4f84c8e91f17a9fa6e54985326950adb3a8cb9411f085daecd51b5

Analysis

Target
before.dll
Size 480KB
Sample220407-fxj1wsbhd9
SHA256 3afb4ff25f4f84c8e91f17a9fa6e54985326950adb3a8cb9411f085daecd51b5
MD5 efc5971616dbead4d725fc3750938911
SHA1 75341c88f4ba71d07ab64f2dfcdc692ee95eefef
SHA512 6f075a3a217489539e610dfd083cf684f1ead36b0a41bd9588932e17c7d68909678d6b73977147c3ddeaba3f0dd51e4fa681bcd3e989040d184d1f4ba800a857
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
1368	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ktyfeb\vwbuymhfobbred.zqf	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	regsvr32.exe
1368	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4192	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4192	3500	regsvr32.exe	80
PID 3500 wrote to memory of 4192	3500	regsvr32.exe	80
PID 3500 wrote to memory of 4192	3500	regsvr32.exe	80
PID 4192 wrote to memory of 1368	4192	regsvr32.exe	81
PID 4192 wrote to memory of 1368	4192	regsvr32.exe	81
PID 4192 wrote to memory of 1368	4192	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\before.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\before.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ktyfeb\vwbuymhfobbred.zqf"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1368

vwbuymhfobbred.zqf

Path C:\Windows\SysWOW64\Ktyfeb\vwbuymhfobbred.zqf
Size 480KB
SHA256 3afb4ff25f4f84c8e91f17a9fa6e54985326950adb3a8cb9411f085daecd51b5
MD5 efc5971616dbead4d725fc3750938911
SHA1 75341c88f4ba71d07ab64f2dfcdc692ee95eefef
SHA512 6f075a3a217489539e610dfd083cf684f1ead36b0a41bd9588932e17c7d68909678d6b73977147c3ddeaba3f0dd51e4fa681bcd3e989040d184d1f4ba800a857
SSDEEP 6144:XJDdcNtINDR6/qONZyPf71mOFFxFpkHPJM972QHnJPFVkecjYxZCg1vqe3oz:XJDdWtINDccPf71v7zWwpzkjjib5qN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-130-0x0000000002410000-0x0000000002433000-memory.dmp

Download

memory/4192-125-0x0000000002980000-0x00000000029A3000-memory.dmp

Download