TSPY_EMOTET.AUSJKM

This Spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Spyware drops and executes the following files:

• %System%\{random alphanumeric characters}.exe
• %System%\dcomevent.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\dcomevent
ImagePath = %System%\dcomevent.exe

Other Details

This Spyware connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.73.150

It deletes itself after execution.