emotet | c7f42dfe661911e3a935a300a276a75ac55768e87bef45deb6ab4e7a2b4ab8e7

Analysis

Target
paste.dll
Size 516KB
Sample220407-fxkbnabhe2
SHA256 c7f42dfe661911e3a935a300a276a75ac55768e87bef45deb6ab4e7a2b4ab8e7
MD5 0a6c17ce0a0a9a82da2851962016ad25
SHA1 f94eab5437b761a7fb4c4ebaacf389eaa5d4645c
SHA512 4a945814235794d8498e9d048fd843331d419d79f68305375fb21b0757e096c5c1ad9f0094a3ccd7f63e8ed5b9a6b6974f9eed70f5ca77933976f3ffe88831e5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
3096	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hpobjk\pafscdgydephr.nrp	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3096	regsvr32.exe
3096	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4636	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4636	4128	regsvr32.exe	80
PID 4128 wrote to memory of 4636	4128	regsvr32.exe	80
PID 4128 wrote to memory of 4636	4128	regsvr32.exe	80
PID 4636 wrote to memory of 3096	4636	regsvr32.exe	81
PID 4636 wrote to memory of 3096	4636	regsvr32.exe	81
PID 4636 wrote to memory of 3096	4636	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\paste.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\paste.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Hpobjk\pafscdgydephr.nrp"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3096

pafscdgydephr.nrp

Path C:\Windows\SysWOW64\Hpobjk\pafscdgydephr.nrp
Size 516KB
SHA256 c7f42dfe661911e3a935a300a276a75ac55768e87bef45deb6ab4e7a2b4ab8e7
MD5 0a6c17ce0a0a9a82da2851962016ad25
SHA1 f94eab5437b761a7fb4c4ebaacf389eaa5d4645c
SHA512 4a945814235794d8498e9d048fd843331d419d79f68305375fb21b0757e096c5c1ad9f0094a3ccd7f63e8ed5b9a6b6974f9eed70f5ca77933976f3ffe88831e5
SSDEEP 6144:4zthhRLAshjAuGy7xt+kDC8l2DGMLaiGX7I1gZSUiNH/pY5hgx6fqez0xh0:4ztLRLDKwHhDC8szkUDHRTMkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3096-130-0x0000000000730000-0x0000000000753000-memory.dmp

Download

memory/4636-126-0x0000000002EF0000-0x0000000002F13000-memory.dmp

Download