emotet | baaa91c7fc64799e0d0962abfed2a7f0dba827f9c938650b7c40b9bb016ab63c

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 22:45

Target
em.dll
Size 629KB
Sample221102-2pdd2acdg7
SHA256 baaa91c7fc64799e0d0962abfed2a7f0dba827f9c938650b7c40b9bb016ab63c
MD5 3a465fe61614b0c1d77e3e3fdea8c09a
SHA1 c35d1274187265988eeaa2fc0e9efd404da80724
SHA512 3dd0cb5c855fdaff560c821e6f587c4b0aeb708d5d04be15c0bd28b8aef98d05eb0e18650f62d206a695011f109114cdb9c4bf977eeebef91cd0426dea24d3d1
SSDEEP 12288:6tGis7p49VmD3OjG7QbBtL55WhNye5JHKVu6cig1Doa:6tGis1T3OjueL+hd5NKAD3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
896	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1168	896	regsvr32.exe	28
PID 896 wrote to memory of 1168	896	regsvr32.exe	28
PID 896 wrote to memory of 1168	896	regsvr32.exe	28
PID 896 wrote to memory of 1168	896	regsvr32.exe	28
PID 896 wrote to memory of 1168	896	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TKuclWPsTgrMEnPWO\mKyeJMnE.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168

memory/896-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Download

memory/896-55-0x0000000180000000-0x000000018002F000-memory.dmp

Download