emotet | 46fcf3750bb2a1459bacd286d6749b35c1d2e64fdb7479b2ead96e3525baf3ec

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:11

Target
em7.dll
Size 629KB
Sample221102-259geafcap
SHA256 46fcf3750bb2a1459bacd286d6749b35c1d2e64fdb7479b2ead96e3525baf3ec
MD5 ad27d89dcd675fef330e54d40ecb30f4
SHA1 09d5cf57b72d34c3ed8924b32e889198c9a73f2e
SHA512 0fe823d80502b6ca24e4e5e53150cc8296ed030dda81fcb125c03de024815e9cbbe79e6b08b5e0233c247a7605d3072afdb147f1d347b802370ba58cb85121ed
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtLQ5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLXhd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1064	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 892	1064	regsvr32.exe	27
PID 1064 wrote to memory of 892	1064	regsvr32.exe	27
PID 1064 wrote to memory of 892	1064	regsvr32.exe	27
PID 1064 wrote to memory of 892	1064	regsvr32.exe	27
PID 1064 wrote to memory of 892	1064	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em7.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQtNkdjvxxdQUFcU\SrtcVPZGuLLi.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892

memory/1064-54-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Download

memory/1064-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download