emotet | 27dd7c195b62f7505a6e2607c5a3202eee565a5cac5222fa9e2eb1e756246886

Analysis

Target
wnkvxmti.dll
Size 904KB
Sample220421-ysdx7agea8
SHA256 27dd7c195b62f7505a6e2607c5a3202eee565a5cac5222fa9e2eb1e756246886
MD5 18438898accea72967e5400222d00b2a
SHA1 6934ceb3ceff400ae8535bd904584834756ec77e
SHA512 42ab3a1f5545d238205070621e197c930d6885c094aaedde60519ceb4c8e7d1748f2bbd87dc69922ef5446196b7c0d91ae7873bac995337a3ad6642702056f46
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Loads dropped DLL 1 IoCs

pid	Process
2216	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Tgdycpybngjd\lchjdofyejc.ugv	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	regsvr32.exe
2216	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2428	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2428	3132	regsvr32.exe	79
PID 3132 wrote to memory of 2428	3132	regsvr32.exe	79
PID 3132 wrote to memory of 2428	3132	regsvr32.exe	79
PID 2428 wrote to memory of 2216	2428	regsvr32.exe	80
PID 2428 wrote to memory of 2216	2428	regsvr32.exe	80
PID 2428 wrote to memory of 2216	2428	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wnkvxmti.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wnkvxmti.dll
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Tgdycpybngjd\lchjdofyejc.ugv"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2216

lchjdofyejc.ugv

Path C:\Windows\SysWOW64\Tgdycpybngjd\lchjdofyejc.ugv
Size 904KB
SHA256 27dd7c195b62f7505a6e2607c5a3202eee565a5cac5222fa9e2eb1e756246886
MD5 18438898accea72967e5400222d00b2a
SHA1 6934ceb3ceff400ae8535bd904584834756ec77e
SHA512 42ab3a1f5545d238205070621e197c930d6885c094aaedde60519ceb4c8e7d1748f2bbd87dc69922ef5446196b7c0d91ae7873bac995337a3ad6642702056f46
SSDEEP 12288:R8q2m092irmW0bkvW3ZYI3tNZzw2gYGly:R8rrr0bMLAj6VYGly
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2216-136-0x0000000002540000-0x0000000002567000-memory.dmp

Download

memory/2428-131-0x0000000000E10000-0x0000000000E37000-memory.dmp

Download