emotet | ff7c0b5bc5e66d527357806e3e5d5f4ad8fe346c9cf9c76b0287d7354098e57b

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:21

Target
em12.dll
Size 727KB
Sample221102-3bz7bafcdp
SHA256 ff7c0b5bc5e66d527357806e3e5d5f4ad8fe346c9cf9c76b0287d7354098e57b
MD5 f9d76cb24542e55ce9a5910e50ce0734
SHA1 d69625510e361a87dcbe11d6789209891f0b1f0f
SHA512 c94fe8a391e4f991084b60d670708ee41784e05bfff75d54228624f1747f9bf051944d3dc46fed1b2944883f212f63b9a4880473c7c20d876a3a698209257745
SSDEEP 12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+iSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6bjtJqzf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1092	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1972	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1972	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1972	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1972	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1972	1092	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em12.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BXMkNoTVoXMruQFV\fFFfuFmLEa.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

memory/1092-54-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Download

memory/1092-55-0x0000000180000000-0x0000000180030000-memory.dmp

Download