emotet | c044fe7f543d60cc4e02b0ca436a89e0a95bdbdfc3a68df1abf67e06f732ae9a

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:17

Target
em10.dll
Size 629KB
Sample221102-29pb2acfd3
SHA256 c044fe7f543d60cc4e02b0ca436a89e0a95bdbdfc3a68df1abf67e06f732ae9a
MD5 7813d51c2713714a66bc202fa1a61789
SHA1 5d998fd3ac4a92bc0a7178c9cf8fe532ab0eb304
SHA512 a2832db0153d4b2b45385316e705a33974e6e656a5e5c8acb6da1c89ec530136bc8e4027cc5692b4e43af911de087ae1214f11bd75aa38bd5c821f89666247a1
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtLr5WhNye5JHKVu6cig1Doa:6tGis1T3OjueL8hd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1784	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1436	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1436	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1436	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1436	1784	regsvr32.exe	28
PID 1784 wrote to memory of 1436	1784	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em10.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JmaPlDgRgQCurW\pbczaGLi.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436

memory/1784-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Download

memory/1784-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download