emotet | 16444b205c7605eea59960583788f95dce5a2238fee59f492a8512feb4349db5 | Triage

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 23:23

Sharing

Report Analysis Logs

General

Target

em14.dll
Size

629KB
MD5

6abe95a2ae69028b5f2532d0de8ccd98
SHA1

36a5aff5fb2a7370377917af941065bbf081c007
SHA256

16444b205c7605eea59960583788f95dce5a2238fee59f492a8512feb4349db5
SHA512

8eda5a2b1654d02e5aba268d88c3ca1da35b344ce766a233bb7dc1febfb8f9a454ea59a233ea42a73f58691d8f0cc9ecbcc2fb8cc6ffcb7ffc440e200f9d76d9
SSDEEP

12288:6tGis7p49VmD3OjG7QbBtLf5WhNye5JHKVu6cig1Doa:6tGis1T3OjueLohd5NKAD3

Score

10^/10

emotet banker trojan

Malware Config

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1044	regsvr32.exe
1444	regsvr32.exe
1444	regsvr32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1044	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27
PID 1044 wrote to memory of 1444	1044	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\em14.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ULZUFkSFhPwSnAWa\DqklI.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x000007FEFB821000-0x000007FEFB823000-memory.dmp

Filesize
8KB

Download
memory/1044-55-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download