emotet | f7219969733a86c39100aefbc89b76dd37fd7663cb61543dae258eaf02189089

Analysis

Target
f721.dll
Size 780KB
Sample220419-yzy7psaefl
SHA256 f7219969733a86c39100aefbc89b76dd37fd7663cb61543dae258eaf02189089
MD5 cf86a52660b106f2fa887736ac1cb039
SHA1 ddb6e211d88acaa9051b6c1659c1e1f2ff633aad
SHA512 a0c331db316348efb01b9f77117f830968dd189dfc98fe972aed4594bdb2bed90630739ffc1698b1e91f43731e6c69784a21212563132ee05dd367a6bead391e
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Loads dropped DLL 1 IoCs

pid	Process
3056	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Egrtgegad\fpyaufw.tkh	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3056	regsvr32.exe
3056	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4468	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4468	4512	regsvr32.exe	79
PID 4512 wrote to memory of 4468	4512	regsvr32.exe	79
PID 4512 wrote to memory of 4468	4512	regsvr32.exe	79
PID 4468 wrote to memory of 3056	4468	regsvr32.exe	80
PID 4468 wrote to memory of 3056	4468	regsvr32.exe	80
PID 4468 wrote to memory of 3056	4468	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f721.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f721.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Egrtgegad\fpyaufw.tkh"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3056

fpyaufw.tkh

Path C:\Windows\SysWOW64\Egrtgegad\fpyaufw.tkh
Size 780KB
SHA256 f7219969733a86c39100aefbc89b76dd37fd7663cb61543dae258eaf02189089
MD5 cf86a52660b106f2fa887736ac1cb039
SHA1 ddb6e211d88acaa9051b6c1659c1e1f2ff633aad
SHA512 a0c331db316348efb01b9f77117f830968dd189dfc98fe972aed4594bdb2bed90630739ffc1698b1e91f43731e6c69784a21212563132ee05dd367a6bead391e
SSDEEP 12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rI5CGNHrH2tZ+d+:gMV/rI5tqb+g
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3056-136-0x00000000023A0000-0x00000000023C7000-memory.dmp

Download

memory/4468-131-0x0000000002260000-0x0000000002287000-memory.dmp

Download