emotet | 8d3bb8fd36d20868dbb952eff9dd1c6ee326064dacdb44ea4e0b81dc68a4b138

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 22:50

Target
em.dll
Size 727KB
Sample221102-2r89gsceb2
SHA256 8d3bb8fd36d20868dbb952eff9dd1c6ee326064dacdb44ea4e0b81dc68a4b138
MD5 d9b469ea18de530d3bb94a10220c4d82
SHA1 af5a16c5e4c418c7491b684c0f21aa636a4751c0
SHA512 0f8190ba901c7f46e770e151a7628d964faa48276fec17b92553a51ef4c55995ac30e16a401d7aa190d146e538470572fb392c59999556c66895bc7cebea497a
SSDEEP 12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+ZSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6gjtJqzf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1576	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1712	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1712	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1712	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1712	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1712	1576	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XWGmKA\mutUhHdtVCN.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

memory/1576-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Download

memory/1576-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download