emotet | 7c53c1b5a9ca13dde2897dda8db1e9eeabeb980f5a655f5cddfb48a143dd84c1

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:15

Target
f27221016edb4951b6a2db3eafc35830.dll
Size 629KB
Sample221102-28jp6afccj
SHA256 7c53c1b5a9ca13dde2897dda8db1e9eeabeb980f5a655f5cddfb48a143dd84c1
MD5 f27221016edb4951b6a2db3eafc35830
SHA1 e3e4a4ceee4e7f085ea4efbda5f6c64768626533
SHA512 d4e4107477195c20aa18ba5cc1557b1787a8bc000d39fd52238e34ca276899afedd67386dcdc2ee282dd926ff68e5eb75306cebe38678d4089c2a0306eb24aeb
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtLK5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLFhd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 272	1280	regsvr32.exe	27
PID 1280 wrote to memory of 272	1280	regsvr32.exe	27
PID 1280 wrote to memory of 272	1280	regsvr32.exe	27
PID 1280 wrote to memory of 272	1280	regsvr32.exe	27
PID 1280 wrote to memory of 272	1280	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f27221016edb4951b6a2db3eafc35830.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HysChxtIwgcVZuH\WylIxJPC.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:272

memory/1280-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download

memory/1280-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download